support-download[.]wixstudio[.]com

PhishDestroy has marked support-download.wixstudio.com as ACTIVE and UNDER INVESTIGATION, confirming its use as a cryptocurrency drainer campaign designed to siphon digital assets from unsuspecting users. This domain carries a RISK LEVEL classified by our analysts as HIGH PRIORITY due to its operational status as a drainer kit delivered through a convincing impersonation of Wix’s official support infrastructure. The malicious domain resolves to IP 34.144.206.118 and is backed by a valid Let’s Encrypt SSL certificate, both tactics intended to lower user suspicion while enabling malicious script execution. At present, VirusTotal shows 0 positive detections out of 95 engines, indicating this campaign has evaded most automated detection systems, though human-vetted threat intelligence remains critical.

This domain was flagged using seed 19a03a and cross-referenced against multiple telemetry sources. According to our analysis, support-download.wixstudio.com shows no prior reputation on PhishDestroy blocklists, and WHOIS data indicates recent registration aligned with malicious infrastructure patterns. The absence of detections on VirusTotal (9/95) is noteworthy and highlights the evasive nature of modern cryptocurrency drainers, which often operate under the radar until significant losses are reported. The IP 34.144.206.118 is part of a broader cloud-hosted range associated with dynamic malicious activity, further underscoring the need for behavioral and reputation-based detection over static signatures. Let’s Encrypt’s certificate authority plays no role in validating intent; it only confirms basic encryption capability, a common tactic abused by phishing operators to appear legitimate.

To mitigate exposure to support-download.wixstudio.com and similar cryptocurrency drainers, users must avoid clicking on links from unsolicited emails or pop-ups claiming to lead to Wix downloads. Always verify download sources directly from the official domain (wix.com) via manually typed URLs or trusted bookmarks. Hardware wallet users should ensure their firmware is updated and transaction simulation features are enabled to detect unauthorized outgoing transfers. If exposed, immediately revoke any connected wallet permissions through your wallet’s interface and monitor transactions for unauthorized outflows. Report suspicious domains like support-download.wixstudio.com to PhishDestroy for immediate blocklisting and community protection. Always treat unsolicited support domains with extreme caution—legitimate service providers rarely host download tools on subdomains outside their core infrastructure.