chain-desktop[.]wixstudio[.]com

PhishDestroy identifies chain-desktop.wixstudio.com as an active crypto-draining campaign masquerading as a Chain-branded desktop wallet. Users who connect wallets to this Wix-hosted site risk unauthorized transfers from supported chains, including Ethereum and Layer-2 networks. The domain leverages a legitimate-looking Wix subdomain (wixstudio.com) and a recent Let’s Encrypt SSL certificate to appear trustworthy. Initial intelligence shows zero detections across 95 VirusTotal scanners, underscoring how new and evasive this threat remains.

This domain was flagged with risk level under_investigation and resolves to IP 34.144.206.118. Registrar data and creation timelines are still being collected, but the Let’s Encrypt certificate combined with zero VirusTotal detections indicates the actors prioritize rapid deployment over long-term persistence. Known indicators include the seed identifier 4ccda9 and a direct correlation to crypto-draining scripts that monitor wallet balances and prompt fake “connect” or “sign” requests.

If you visited chain-desktop.wixstudio.com, immediately revoke any wallet connections using your wallet’s interface or a reputable revoke tool like revoke.cash. Disconnect the site from your browser and clear related site data. Do not re-enter your seed phrase or private keys. Report the domain to PhishDestroy for further analysis and share any transaction hashes or wallet addresses connected to the site for incident response. Monitor your wallets closely for unauthorized transfers and consider moving remaining assets to a fresh wallet with new keys.