platform-en-us[.]wixstudio[.]com

PhishDestroy identifies platform-en-us.wixstudio.com as an active crypto drainer operating under brand impersonation of WixStudio. This malicious domain leverages the trusted WixStudio platform to deceive victims into connecting cryptocurrency wallets, enabling unauthorized fund transfers. The threat actor behind this campaign is actively distributing drainer scripts through this domain, which masquerades as legitimate WixStudio content. Technical analysis confirms the domain hosts drainer kits designed to target crypto wallet connections, posing severe financial risk to unsuspecting users who interact with the fraudulent site. Initial intelligence suggests this is part of a broader campaign targeting design and development communities familiar with WixStudio tools.

This domain resolves to IP address 34.144.206.118 and is currently protected by a Let's Encrypt SSL certificate, which provides a false sense of security to potential victims. According to VirusTotal analysis dated from seed 4cf5e8, the domain shows 0 detections out of 95 security engines, indicating it has not yet been widely flagged as malicious. The domain was registered through an unnamed registrar and shows no current presence on Google Safe Browsing (GSB) blocklists. While the exact creation date is not publicly available, the domain's recent activity and lack of detections suggest it is a newly deployed threat actor resource. Blocklist monitoring services currently show zero detections across public threat intelligence feeds.

As of the latest analysis, platform-en-us.wixstudio.com remains in an active state with a risk level marked as under investigation. Immediate response actions include updating network and endpoint security rules to block access to this domain and its associated IP address. Users are strongly advised to avoid any interaction with this site and verify the authenticity of WixStudio-related links through official channels. The current threat assessment indicates medium operational risk due to the active status and lack of widespread detection, but proactive blocking can significantly reduce exposure. Remaining risk includes potential expansion of this campaign using similar domain naming conventions or infrastructure, requiring continued vigilance and updated threat intelligence sharing within security communities.