appsuite-official[.]wixstudio[.]com

PhishDestroy identifies appsuite-official.wixstudio.com as an active crypto drainer impersonating official application suites. This domain leverages a Wix-hosted subdomain to masquerade as legitimate software support, tricking users into connecting crypto wallets for fraudulent transactions. The campaign employs deceptive branding to exploit trust in established software ecosystems, with infrastructure hosted on Google Cloud (IP 34.144.206.118) and a valid Let's Encrypt SSL certificate to appear authentic. This domain exhibits multiple red flags confirmed by threat intelligence: VirusTotal currently shows 4/95 detection engines flagging it, indicating a newly deployed or evasive threat. While the Wix domain registration details remain obscured through privacy protection, the infrastructure points to rapid deployment on cloud services. The SSL certificate issued by Let's Encrypt suggests an attempt to bypass security controls that whitelist known issuers. Historically, similar campaigns have surged within 72 hours of domain creation, with attackers abandoning infrastructure after financial gains. Users who visited this domain should immediately revoke any connected wallet permissions, transfer remaining assets to a clean wallet, and scan their devices for malware. Block the domain at the network level and report the incident to relevant authorities. Monitor financial accounts for unusual transactions and consider this domain compromised for all future interactions. Given the 0% detection rate, traditional security tools may not yet recognize this threat, requiring heightened user vigilance.