designbycodo[.]wixstudio[.]com

PhishDestroy identifies designbycodo.wixstudio.com as a generic phishing domain under active investigation for cryptocurrency drainer activity. This WixStudio-hosted page leverages a compromised or fraudulent design studio branding to deceive users into connecting cryptocurrency wallets under the false premise of portfolio visualization or NFT previews. The threat operates by prompting users to sign malicious transactions via wallet approval prompts, which silently drain tokens to attacker-controlled addresses. No specific drainer kit has been publicly identified for this domain yet, but its functional behavior aligns with known drainer scripts such as those observed in AngelDrainer or Inferno Drainer toolkits. This domain resolves to the IP address 34.144.206.118 and is secured with a valid Let's Encrypt SSL certificate, likely intended to appear legitimate and evade browser warnings. According to VirusTotal, the site has 0 detections out of 95 security engines as of the seed timestamp ea352d, indicating it remains under the radar of mainstream detection systems. The domain is hosted on Wix’s infrastructure via WixStudio, a platform often abused for quick deployment of fraudulent landing pages due to its ease of use and low barrier to entry. Creation date and registrar details are not disclosed in the provided data, but the active status and lack of detection suggest recent deployment aimed at capitalizing on trending NFT or Web3 narratives. Google Safe Browsing (GSB) status and blocklist inclusion status are currently unknown, but the absence of detections implies low prior exposure to blocklists. As of now, the domain remains active and poses an active threat to cryptocurrency users, particularly those engaging with NFTs or Web3 platforms. Immediate actions include blocking the domain at the network level using the IP 34.144.206.118 and domain hash (designbycodo.wixstudio.com), and flagging it in threat intelligence feeds. Users are advised to avoid any interaction requiring wallet connections and report the domain to their wallet providers and security teams. While the risk is currently categorized as 'under investigation,' the combination of active hosting, no detections, and drainer-like behavior elevates the potential impact significantly. Continuous monitoring and updating of blocklists are essential to mitigate further abuse.