coinbsspro[.]wixstudio[.]com

PhishDestroy identifies coinbsspro.wixstudio.com as an active crypto drainer site masquerading as BSS Pro, a legitimate crypto asset platform. This domain leverages WixStudio hosting to deploy a generic phishing kit designed to steal cryptocurrency funds via fake asset transfers or wallet draining mechanisms. The threat actor behind this campaign appears to be targeting users searching for BSS Pro services, aiming to compromise victims' wallets through deceptive deposit addresses or fraudulent transactions. While the specific drainer kit variant remains unverified, the infrastructure suggests a low-to-moderate sophistication level, relying on trusted hosting and SSL certificates to evade detection.

Technical examination of coinbsspro.wixstudio.com reveals critical indicators for defensive prioritization. The domain resolves to a Google Cloud IP (34.144.206.118) and utilizes a Let's Encrypt SSL certificate to establish legitimacy. VirusTotal currently flags the domain with 5 out of 95 detections, highlighting its ability to bypass initial antivirus and sandbox scrutiny. Registered under Wix's internal registrar (Wix.com LLC), the domain's creation date and historical blocklist status remain unverified in public sources, though its active status and consistent resolution to the same IP suggest a freshly deployed campaign. No immediate matches appear in Google Safe Browsing (GSB) or major threat intelligence feeds at this time, further emphasizing its stealthy profile.

Despite its current low detection rate, coinbsspro.wixstudio.com remains an active and evolving threat requiring immediate containment. SOC teams should prioritize blocking the domain at the DNS and network levels using the resolved IP (34.144.206.118) and associated subdomains. Users should be warned against interacting with this domain or any BSS Pro impersonations, particularly when encountering deposit or wallet-related requests. The remaining risk is classified as under investigation, with potential for heightened activity if the threat actor refines their phishing kit or expands infrastructure. Continuous monitoring for new IOCs, including domain permutations and IP shifts, is critical to preempt further compromise.