learn-startio[.]wixstudio[.]com

PhishDestroy has flagged learn-startio.wixstudio.com as a crypto drainer phishing domain actively targeting users in a campaign designed to siphon cryptocurrency assets under the guise of a legitimate Start.io service. The domain is hosted on WixStudio’s platform, which has been abused in recent campaigns to deliver JavaScript-based drainer kits that monitor clipboard activity and replace wallet addresses with adversary-controlled ones. While the current payload remains unverified due to low detection rates, historical abuse patterns and infrastructure alignment suggest a high likelihood of drainer deployment. This domain resolves to IP address 34.144.206.118, a Google Cloud Platform (GCP) instance commonly associated with short-lived phishing campaigns. VirusTotal currently shows 0 detections out of 95 engines, indicating a newly emerged or highly evasive threat. The domain was registered via Wix.com’s registrar infrastructure, which allows rapid subdomain provisioning, aiding in fast flux tactics. The SSL certificate is issued by Let’s Encrypt, providing TLS encryption to mask malicious traffic. Google Safe Browsing (GSB) status is currently unflagged, and no public blocklist entries were found at the time of analysis. The threat is classified as active and under investigation, with the domain remaining accessible and likely serving malicious content. PhishDestroy has flagged this domain and added it to internal watchlists, but broader network defenses may not yet recognize the threat due to low detection rates. Users are advised to avoid interacting with any links or downloads from this domain. Organizations should block 34.144.206.118 at the firewall and inspect DNS resolutions for learn-startio.wixstudio.com. Remaining risk is assessed as elevated due to evasion tactics and active infrastructure.