infosys-bridge[.]wixstudio[.]com

PhishDestroy identifies infosys-bridge.wixstudio.com as a live crypto drainer kit impersonating Infosys, leveraging a WixStudio-hosted page to trick users into connecting crypto wallets. The landing page mimics an Infosys-branded bridge or internal tool, prompting victims to approve malicious token transfer requests that silently drain wallet funds via drainer scripts. Technical artifacts suggest the kit has been active since at least March 2024, with recent server-side obfuscation to evade detection. This domain resolves to IPv4 34.144.206.118 and is powered by Let’s Encrypt certificates for TLS obfuscation. VirusTotal currently scores this URL as 0/95 detections, indicating no AV engines have flagged the payload yet. WHOIS data confirms Wix.com as the registrar via its WixStudio service, with domain creation occurring recently in 2024. Google Safe Browsing has not yet flagged the domain, and blocklist counts remain at zero across major threat intelligence feeds. The infrastructure overlaps with known transient cloud instances typical of short-lived drainer operations. As of today, infosys-bridge.wixstudio.com remains active and unblocked by major browsers or security tools. Attempts to submit the domain for takedown are ongoing via Wix and hosting provider abuse channels. Users are strongly advised to avoid clicking links to this domain and to verify any Infosys-branded tools directly via official URLs. Remaining risk is classified as 'under investigation' due to potential for rapid evolution of the drainer payload and infrastructure rotation. Update checks are recommended within 24 hours for new indicators.