startt-entrezo[.]wixstudio[.]com

PhishDestroy identifies startt-entrezo.wixstudio.com as an active generic phishing domain leveraging cryptocurrency drainer techniques to steal victim assets. The threat operates through a Wix-hosted studio page, indicative of rapid deployment via legitimate web hosting infrastructure. No direct brand impersonation is observed in current samples, suggesting opportunistic targeting of cryptocurrency users through social engineering or malicious advertisements. The configuration appears consistent with automated drainer kits designed to prompt wallet connections before exfiltrating funds.

This domain was flagged with a VirusTotal detection score of 4/95 as of initial analysis, indicating evasion of current signature-based detection mechanisms. The infrastructure resolves to IP address 34.144.206.118 (hosted on Google Cloud via AS396982), with SSL secured through a Let's Encrypt certificate to enhance credibility. Domain registration details remain obscured by Wix's privacy protection, obscuring registrar and creation date. Google Safe Browsing (GSB) status is currently unflagged, and no blocklist entries were found in public threat intelligence feeds at the time of investigation.

The campaign remains active as of the latest assessment, with continuous operation observed over the monitoring period. No takedown actions have been initiated. The combination of undetected payload delivery, cloud-hosted evasion, and cryptocurrency targeting results in a HIGH risk profile despite low static detection scores. Users are advised to block the domain and IP at network level, avoid wallet connections to unknown domains, and report any suspicious activity to their security teams or cryptocurrency platform providers immediately.