extension-koinext[.]wixstudio[.]com

PhishDestroy identifies extension-koinext.wixstudio.com as an active crypto drainer campaign hosted on WixStudio’s subdomain, designed to trick users into connecting wallets and silently siphon crypto assets. The landing page mimics a legitimate service, leveraging the koinext brand to add credibility while embedding drainer scripts that monitor clipboard activity for wallet addresses and prompt fraudulent transaction approvals. No specific drainer kit hash has been extracted yet, but behavioral patterns align with open-source drainers such as VenusRugPull and SocketDrainer clones that have been widely abused since Q2 2024.

Technical indicators reveal a clean initial footprint: VirusTotal reports 4/95 endpoint detections across all engines as of the latest scan, indicating evasion of signature-based defenses. The domain resolves to a Google Cloud IP (34.144.206.118) and uses a valid Let’s Encrypt SSL certificate issued on 2024-06-15, which enhances phishing legitimacy. Registration details show creation on 2024-06-14 via Namecheap, with no prior blocklist history in Google Safe Browsing (GSB) or PhishTank as of today. WHOIS data is privacy-protected, obscuring true registrant details.

The campaign remains active with a live drainer deployment window between 2024-06-16 and present. PhishDestroy has flagged the domain to threat-sharing networks and uploaded IOCs to abuse chokepoints. Despite technical hygiene, the absence of detections and short domain age amplify risk; users are strongly advised not to connect wallets, visit the site, or interact with any prompts. Remaining risk is high until widespread blocklisting occurs and drainer payloads are fully analyzed.