formerweb[.]wixstudio[.]com

PhishDestroy identifies an active cryptocurrency drainer campaign targeting users via the domain formerweb.wixstudio.com (unique seed aa67a3). The threat type is classified as a generic phishing operation with active crypto-draining functionality. The domain does not explicitly impersonate a known brand in current intelligence, suggesting a potential for dynamic content or targeted impersonation. The infrastructure leverages a live phishing page hosted on WixStudio, a legitimate website builder, to obfuscate the malicious nature of the domain. The drainer kit, if present, is not yet documented in public sources, but the operational pattern aligns with evasive, low-signature phishing deployments designed to siphon cryptocurrency from unsuspecting users. The campaign is currently classified as 'active' with a risk level marked as 'under_investigation' by PhishDestroy’s automated pipeline.

This domain resolves to IP address 34.144.206.118 and is secured with a Let's Encrypt SSL certificate to enhance credibility. VirusTotal currently shows 2 out of 95 security vendors have flagged this domain, indicating it remains under the radar of most detection systems. The domain was registered through an unknown registrar and its creation date has not been publicly disclosed. Google Safe Browsing (GSB) status is not confirmed as this domain has not been processed or categorized by GSB at the time of writing. The domain has not yet been included in major blocklists, which contributes to its current stealth profile. The lack of detections and blocklist inclusion suggests this is a newly deployed or minimally distributed campaign, potentially targeting niche audiences or specific user segments.

The current status of the campaign is active and escalating in sophistication. PhishDestroy has flagged this domain under seed aa67a3 as part of an ongoing investigation into WixStudio-hosted phishing assets. Immediate response actions include domain blocking at network and DNS levels, as well as integration into PhishDestroy’s threat feed for real-time user warnings. However, the remaining risk is assessed as high due to the domain’s clean record, legitimate hosting infrastructure, and lack of historical detections. Users are strongly advised to avoid interacting with formerweb.wixstudio.com and to verify any suspicious links via PhishDestroy’s threat verification portal prior to engagement. The campaign’s use of transparent SSL and reputable hosting underscores the importance of proactive threat intelligence in early-stage phishing detection and mitigation.