en-suiteapps[.]wixstudio[.]com

PhishDestroy identifies en-suiteapps.wixstudio.com as an active crypto drainer campaign impersonating SuiteApps, a legitimate SaaS platform. The domain leverages a WixStudio subdomain to host malicious JavaScript designed to drain cryptocurrency wallets upon user interaction. This tactic exploits trust in familiar SaaS ecosystems to deceive victims into authorizing fraudulent transactions. The campaign targets users searching for SuiteApps-related tools, redirecting them to the malicious domain under the guise of legitimate downloads or integrations.

This domain resolves to IP address 34.144.206.118 and was recently registered using Let's Encrypt for SSL encryption. VirusTotal currently shows 0/95 security vendors flagging the domain, indicating it remains undetected by most scanning engines. The registrar is Wix.com, which may hinder immediate takedown due to legitimate hosting policies. Additionally, the domain is not currently flagged on Google Safe Browsing (GSB) and has no blocklist entries, highlighting a significant detection gap. The combination of a trusted hosting provider, low VT score, and absence from blocklists makes this a high-risk threat to cryptocurrency users.

The domain is currently active and poses a severe risk to users engaging with SuiteApps-related content. Immediate action is required to block access at the network level (DNS, firewall) and update threat intelligence feeds. End users should avoid any links or downloads associated with this domain and report suspicious activity to their security teams. While the domain’s low detection rate is concerning, its reliance on a legitimate Wix subdomain may limit takedown effectiveness. Continuous monitoring and proactive blocking are essential to mitigate potential cryptocurrency losses.