enusexoduus[.]wixstudio[.]com

The domain enusexoduus.wixstudio.com is identified as a high-risk crypto drainer phishing site designed to compromise digital wallet credentials and drain cryptocurrency assets. As of the latest analysis, the domain is offline, though prior activity indicates it operated as a fraudulent platform impersonating legitimate wallet services or decentralized applications. No specific brand impersonation has been confirmed, but the infrastructure aligns with known crypto drainer campaigns targeting users through deceptive transaction prompts or fake login portals. Analysis of technical indicators reveals the domain was flagged by 15 of 95 security vendors on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain was registered on April 30, 2026, through GoDaddy.com, LLC, an atypical future-dated registration that may indicate domain squatting or preemptive malicious infrastructure setup. It resolved to the IP address 34.144.206.118, a cloud-hosted endpoint with no prior association to legitimate services. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and OISD, and employs a Let’s Encrypt SSL certificate, a common tactic to feign legitimacy. The 404 error page currently displayed suggests either takedown or temporary deactivation, though historical data confirms active malicious use. Current status indicates the domain is no longer accessible, but the infrastructure remains a latent threat. Users who interacted with the domain prior to its deactivation should assume credential or asset compromise and take immediate remedial action. Recommended steps include revoking all connected wallet authorizations, transferring assets to a new secure wallet, and monitoring transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP, while users should exercise heightened caution with unsolicited wallet prompts or links from unverified sources. Future monitoring of the registrar and hosting provider may reveal additional malicious domains leveraging similar infrastructure.