entire-bridge[.]wixstudio[.]com

PhishDestroy identifies entire-bridge.wixstudio.com as a live crypto-draining phishing page impersonating an unnamed cryptocurrency brand or wallet service. The domain leverages a Wix Studio landing page to host a JavaScript-based drainer kit designed to siphon tokens from victim wallets under the guise of a legitimate transaction. Security telemetry suggests this is an early-stage campaign; no specific brand has been publicly tied to the payload, but the drainer signature aligns with commodity kits observed in recent wallet-draining operations. The infrastructure is deliberately hosted on a legitimate website-builder platform to evade domain-based detections while enabling rapid rotation and low-cost deployment. IOCs should be treated as high-fidelity due to the active drainer payload and absence of third-party mitigations at this time.

Technical indicators for entire-bridge.wixstudio.com are as follows: VirusTotal detection ratio is 3 out of 95 engines (0 %), domain registered via Wix.com, resolves to IPv4 34.144.206.118 (Google Cloud), and operates under a Let’s Encrypt TLS certificate. The domain was created on 2024-04-10, currently resides in Google Safe Browsing’s “unverified” category, and appears on 2 open-source threat blocklists. No sinkhole or takedown activity has been recorded to date, indicating active adversary control and ongoing campaign operations.

As of this advisory, entire-bridge.wixstudio.com remains ACTIVE with no active takedowns or sinkholing in progress; the presence of a live crypto drainer kit elevates the risk to HIGH until content is removed or the domain is neutralized. Immediate defensive actions include blocking the domain at DNS and proxy layers, adding the IP 34.144.206.118 to firewall deny lists, and updating EDR rules to alert on wallet-drainer JavaScript artifacts. Users should be warned against accessing the domain and reminded to verify destination URLs before signing any transactions. Remaining risk is assessed as HIGH due to the active drainer payload and lack of upstream mitigation; continued monitoring is required until the page is offline or fully remediated.