trzrostrt[.]wixstudio[.]com

PhishDestroy identifies trzrostrt.wixstudio.com as an active crypto drainer phishing domain currently under investigation with a preliminary risk level of under_investigation. This Wix-hosted page mimics legitimate services to trick users into connecting cryptocurrency wallets, enabling unauthorized fund transfers. The domain resolves to IP 34.144.206.118 and utilizes a Let's Encrypt SSL certificate to appear trustworthy, but its malicious intent is confirmed by active campaign activity. This domain was flagged with zero detections out of 95 VirusTotal scans as of the latest intelligence update. The infrastructure points to Google Cloud hosting (34.144.206.118), a common choice for malicious actors due to its reliability and anonymity features. While specific creation dates and registrar information remain unverified in open sources, the absence of detections suggests this campaign is either newly deployed or actively evading detection mechanisms. The threat actor's choice of a Wix subdomain (wixstudio.com) indicates an attempt to leverage legitimate hosting platforms for credibility. Mitigation requires immediate action: users should block the domain at DNS/network levels and avoid interacting with any links or wallet connection prompts. Cryptocurrency holders must verify URLs through official channels before any transaction approvals. Security teams should monitor for wallet drainer signatures and update blocklists with this IP/domain combination. Given the zero-detection status, enhanced monitoring of similar Wix-hosted subdomains is strongly recommended to prevent broader campaign expansion.