gettingstart-desktop[.]wixstudio[.]com

PhishDestroy identifies gettingstart-desktop.wixstudio.com as an active crypto-drainer scam posing as a Windows desktop download portal. This WixStudio-hosted page attempts to trick users into connecting a cryptocurrency wallet under the guise of downloading software, then silently drains funds via a malicious smart-contract approval. Reports indicate the same domain has zero detections across 95 VirusTotal engines, highlighting how signature-based tools often miss fresh loader pages. This domain was flagged by PhishDestroy’s behavioral crawlers on 1b22bb; it resolves to IPv4 address 34.144.206.118 and holds a valid Let’s Encrypt certificate to appear legitimate. Intelligence shows the page mimics the “Getting Started” branding of a popular desktop application, but the download button instead injects a malicious JavaScript payload that requests wallet-connect permissions. VirusTotal currently shows 0/95 detections, yet community sandbox analysis reveals MetaMask, Phantom, and Trust Wallet transaction prompts requesting unlimited token approvals—classic indicators of a crypto-drainer. If you visited this site, immediately revoke any wallet-connect permissions granted to the domain through your wallet’s “Connected Sites” or “Approved” list. Do not interact with any further prompts asking for private keys or seed phrases. Use PhishDestroy’s wallet-revocation tool to batch-reject suspicious approvals, then run a malware scan on your device. Report the domain to your wallet provider and to PhishDestroy to help block the threat for others.