exaduss-apps[.]wixstudio[.]com

Domain PhishDestroy identifies—exaduss-apps.wixstudio.com—hosts a live crypto drainer campaign aimed at unsuspecting cryptocurrency holders. This malicious site masquerades as a legitimate application portal, enticing victims to connect their wallets under the false pretense of accessing exclusive features or rewards. Upon interaction, the drainer silently siphons authorized access to digital assets via deceptive transaction prompts, leveraging social engineering tactics to bypass user scrutiny. The domain leverages a WixStudio subdomain to enhance credibility, exploiting the platform’s trusted reputation to evade initial suspicion.

Technical analysis reveals a concerning lack of detection, with VirusTotal currently scoring 0 detections out of 95 scanners, indicating minimal awareness within the security community. The domain resolves to static IP 34.144.206.118 and operates under a Let’s Encrypt SSL certificate, adding superficial legitimacy. Historical data shows this domain is newly observed, with no prior blocklist entries or associated malicious infrastructure, suggesting a recently operational campaign. Additionally, the presence of a WixStudio subdomain often indicates a low-cost, rapid-deployment strategy favored by financially motivated threat actors.

Users who accessed this domain or entered wallet credentials should immediately revoke any active permissions in their wallet software and transfer remaining assets to a clean address. Monitor blockchain transactions for unauthorized transfers and enable transaction alerts if supported by your wallet provider. Report the domain to your wallet platform and consider revoking browser permissions. If funds were stolen, file a report with local law enforcement or cybercrime units and preserve browser artifacts for potential forensic analysis. Organizations should update blocklists to include this domain and IP address to prevent further exposure.