en-trezsuites[.]wixstudio[.]com

PhishDestroy identifies en-trezsuites.wixstudio.com as a newly activated generic phishing domain operating as a crypto drainer, designed to trick users into connecting compromised cryptocurrency wallets. The domain masquerades under the Wix Studio platform, leveraging its subdomain structure to appear legitimate at first glance. No specific brand impersonation has been confirmed yet, but the generic nature of the domain suggests opportunistic targeting of crypto users seeking wallet management or exchange services. The threat is classified as a high-risk crypto drainer due to its active infrastructure and lack of detection on major security platforms.

This domain resolves to IP address 34.144.206.118 and is hosted on infrastructure associated with Google Cloud Platform (ASN 15169). The SSL certificate is issued by Let's Encrypt, providing a false sense of security with valid HTTPS encryption. VirusTotal currently shows 0 detections out of 95 engines, indicating that mainstream antivirus and security tools have not yet flagged this domain. The domain was registered recently, though the exact creation date is not publicly disclosed. Google Safe Browsing (GSB) has not yet classified this domain as malicious, and it remains absent from major blocklists such as PhishTank and OpenPhish. These characteristics suggest the threat actor is operating under the radar, likely in the early stages of a campaign.

As of the latest analysis, the domain remains active and under investigation, with no definitive remediation actions taken by hosting providers or security vendors. The current risk level is assessed as 'under_investigation,' meaning the threat potential is not yet fully quantified. Users are strongly advised to avoid interacting with this domain and to verify any similar URLs using PhishDestroy’s real-time scanning tools. The absence of detections on VirusTotal and other platforms highlights the importance of proactive threat hunting, as traditional security measures may lag behind emerging phishing campaigns. Remaining risk includes potential expansion of the campaign to target more users or integration with additional malicious infrastructure. Immediate reporting and blocking of this domain are recommended to mitigate further exposure.