desktop-cloud-en[.]wixstudio[.]com

PhishDestroy identifies desktop-cloud-en.wixstudio.com as a potential crypto drainer fraudulently hosted on Wix’s platform under the wixstudio.com subdomain. The page mimics legitimate cloud-desktop services to trick users into connecting crypto wallets and signing malicious transactions that silently drain funds. No specific drainer kit (e.g., liquifier, venus, rainbow) has been confirmed via signature analysis, but behavioral patterns align with generic drainer scripts commonly injected via compromised or fraudulent Wix templates. The threat vector targets users seeking remote desktop solutions, exploiting trust in Wix’s brand infrastructure to evade detection.

Technical indicators place this domain under active scrutiny. VirusTotal currently returns 4 out of 95 antivirus engines detecting malicious content, indicating low signature coverage despite behavioral anomalies. The domain resolves to IP 34.144.206.118 and uses a valid Let’s Encrypt SSL certificate. Domain registration details are obscured via privacy protection through Wix, showing only registrar as Wix.com Ltd. with no publicly accessible creation date. Google Safe Browsing (GSB) has not yet flagged this domain, and no significant blocklist presence is recorded across major threat intelligence feeds, including PhishTank and OpenPhish. The absence of detections suggests either a newly deployed campaign or a delayed response from detection systems.

Currently, the domain remains active and under investigation with a status classified as 'under_investigation' and risk level pending further analysis. Immediate response actions include domain takedown requests to Wix and notification to hosting provider via abuse channels. Users are strongly advised to avoid visiting or interacting with this domain, especially when prompted for wallet connections. As this threat evolves, security teams should monitor for similar Wix-hosted crypto-draining campaigns and update browser-based blocklists accordingly. Remaining risk is assessed as moderate due to low detection coverage and potential for rapid expansion across similar services.