en-downloads[.]wixstudio[.]com

PhishDestroy identifies en-downloads.wixstudio.com as a crypto drainer actively mimicking Wix Studio’s download portal. The threat aligns with generic phishing tactics, leveraging deceptive branding to trick users into connecting crypto wallets or downloading malicious payloads. This domain is part of a broader campaign targeting users seeking legitimate Wix tools or templates, with infrastructure designed to exfiltrate cryptocurrency assets or harvest credentials.

This domain resolves to IP 34.144.206.118 and operates under a Let’s Encrypt SSL certificate, adding superficial legitimacy. VirusTotal currently shows 3/95 detection score, indicating evasion of mainstream security engines. The domain is hosted on Wix’s infrastructure (WixStudio), which may lend credibility to unsuspecting users. Creation date and registrar details remain unverified at this stage, but the infrastructure’s recency and hosting provider suggest opportunistic abuse of reputable platforms.

PhishDestroy has flagged this domain as active with a crypto drainer payload under seed 4733b3. As of now, no blocklist entries or Google Safe Browsing (GSB) flags have been recorded, leaving users vulnerable. Immediate verification via PhishDestroy is recommended to prevent interaction. The residual risk remains high due to the domain’s active status and low detection rate, warranting continued monitoring and proactive blocking.