admin-desktop[.]wixstudio[.]com

PhishDestroy identifies admin-desktop.wixstudio.com as an active crypto drainer domain impersonating Wix, a popular web hosting platform. The domain leverages a generic phishing technique to deceive users into connecting cryptocurrency wallets or entering seed phrases under false pretenses. This type of attack typically involves malicious JavaScript payloads embedded within spoofed login portals or fake 'admin panel' interfaces, designed to siphon digital assets without user awareness. The threat is classified as a drainer kit due to its automated extraction of wallet credentials and transaction signing capabilities, posing direct financial risk to cryptocurrency holders.

Technical indicators confirm this domain’s malicious intent. VirusTotal currently reports 4/95 detection engines flagging the domain, indicating it evades mainstream antivirus and security vendor coverage. The domain resolves to IP 34.144.206.118, a Google Cloud Platform (GCP) address commonly associated with transient malicious infrastructure. The SSL certificate is issued by Let's Encrypt, a legitimate provider often abused by threat actors to establish false trust. While the registrar and creation date are not publicly disclosed in this dataset, the domain’s behavioral profile aligns with recently activated malicious infrastructure designed for short-term operations. Google Safe Browsing (GSB) status remains unconfirmed in open sources, but the absence of detections suggests a newly deployed or highly evasive campaign.

This domain remains active and under active threat investigation by PhishDestroy. Current status is marked as 'active', with no confirmed takedowns or blocklist entries recorded. Users are strongly advised to avoid interacting with this domain and to verify any Wix-related links using PhishDestroy’s real-time scanning tool. The remaining risk is evaluated as high due to the absence of detection coverage and the domain’s active status. Immediate action includes network-level blocking of 34.144.206.118 and user education on recognizing crypto drainer red flags such as unsolicited admin links or wallet connection prompts.