browzer-bridge[.]wixstudio[.]com

PhishDestroy identifies browzer-bridge.wixstudio.com as a live crypto drainer domain masquerading as a legitimate wallet interface. The domain leverages a generic phishing approach, likely targeting cryptocurrency users by presenting fraudulent login or transaction pages designed to siphon funds. While the exact drainer kit remains unverified, the infrastructure suggests a rudimentary yet functional setup, consistent with low-to-mid complexity threats observed in similar campaigns. The operational goal appears to be credential harvesting or direct crypto asset exfiltration via malicious transaction prompts, a common tactic in browser-based phishing kits.

Technical analysis reveals key indicators: the domain resolves to IP 34.144.206.118 and utilizes a Let's Encrypt SSL certificate, which may be used to evade detection by appearing legitimate. VirusTotal currently scores the domain at 4/95 detections, indicating no immediate flagging by antivirus engines. The domain is hosted on WixStudio, a legitimate platform that may be abused for hosting phishing content. Creation date and registrar details remain unpublished or obfuscated, which is atypical for legitimate services and suggests deliberate concealment. Google Safe Browsing (GSB) status is unverified in available intel, and blocklist inclusion counts are not documented, though the domain remains unflagged by major threat intelligence platforms.

As of this advisory, the domain is still active and operational, with no visible takedown efforts or blocklisting observed. The low VT detection rate underscores the challenge of identifying such threats through automated means alone. Immediate remediation is limited due to the domain's active status and the lack of third-party detections; however, proactive blocking at the network level is recommended. Users are advised to cross-reference any wallets or services accessed via this domain using PhishDestroy’s verification tools. The residual risk remains moderate due to the domain’s active state and potential for continued abuse, though the absence of detections suggests it may not yet be widely recognized by threat feeds.