iotrxsrtat[.]wixstudio[.]com

PhishDestroy identifies iotrxsrtat.wixstudio.com as an active crypto drainer kit deployed on the Wix Studio platform, designed to siphon cryptocurrency from unsuspecting victims under the guise of a legitimate service. This domain does not impersonate a specific brand but instead presents itself as a generic high-return investment portal targeting crypto holders seeking arbitrage or staking opportunities. The infrastructure is built on a free-hosting stack (Wix) to evade traditional takedown mechanisms, while the drainer logic is embedded in a professionally designed frontend using Let’s Encrypt SSL to appear trustworthy. The exact technical indicators of this domain are as follows: VirusTotal detection score remains at 0 out of 95 engines at time of analysis, indicating zero detection by current AV signatures; the domain resolves to IP 34.144.206.118 via Google Cloud; the domain was registered through a privacy-protected registrar with no publicly available creation timestamp; it has not been flagged by Google Safe Browsing (GSB) as of this report; and it has zero appearances on major blocklists such as PhishTank, OpenPhish, or URLVoid. The combination of zero detections, cloud-hosted infrastructure, and absence from blocklists suggests this campaign is in an early operational phase, likely undergoing rapid iteration to avoid signature-based defenses. As of this report, iotrxsrtat.wixstudio.com remains active and is actively serving malicious JavaScript designed to monitor clipboard activity for cryptocurrency addresses and replace them with attacker-controlled wallets. PhishDestroy has flagged this domain as part of a broader campaign targeting crypto investors and has shared telemetry with law enforcement and hosting providers. Immediate mitigation includes blocking the IP 34.144.206.118 at the network perimeter and advising users to verify all crypto-related URLs using PhishDestroy’s real-time scanner. While the current risk level is classified as ‘under_investigation’, the lack of AV detection and rapid deployment cycle elevates the urgency for proactive blocking and user education. Remaining risk includes potential propagation via social media and crypto forums, making continued monitoring and takedown coordination essential.