users-liveapp[.]wixstudio[.]com

PhishDestroy identifies users-liveapp.wixstudio.com as a crypto drainer impersonating Wix services, currently active and under investigation. This domain leverages Wix’s trusted brand to deceive users into connecting crypto wallets under the guise of a live application, a common tactic among crypto drainer campaigns. The threat remains unresolved despite SSL certification, indicating a sophisticated and evolving attack vector. This domain resolves to IP 34.144.206.118 and utilizes a Let's Encrypt SSL certificate, which does not inherently indicate legitimacy. Flagged by 7 of 95 VirusTotal vendors as of the latest scan, it evades immediate detection despite its malicious intent. The domain was created recently, with no available historical blocklist data or trust scores, suggesting a potentially ephemeral or newly deployed infrastructure. Its association with Wix, a widely used web development platform, increases the risk of successful impersonation, particularly among non-technical users. As of the latest assessment, users-liveapp.wixstudio.com remains active and unblocked, posing a moderate to high risk to visitors. Users are strongly advised to avoid accessing this domain or interacting with any linked content, especially wallet connection prompts. Organizations should implement network-level blocking for this IP (34.144.206.118) and monitor for related infrastructure. Immediate reporting to security teams and updating threat intelligence feeds is critical to prevent further exploitation. Exercise heightened caution with any Wix-branded or web development-related services, verifying domains through official channels before engagement.