ext-exxodus[.]wixstudio[.]com

PhishDestroy identifies ext-exxodus.wixstudio.com as an active crypto-drainer phishing domain hosted on IP 34.144.206.118 and served with a Let’s Encrypt SSL certificate. This no-code site mimics legitimate crypto services to trick users into approving malicious wallet transactions that silently drain tokens. The domain is still under investigation by major threat-intel feeds; it currently shows 0 detections out of 95 scanners on VirusTotal, indicating early-stage deployment before blacklisting catches up. Technical indicators confirm minimal footprint: the site resolves to a single Google Cloud instance (34.144.206.118), uses a Let’s Encrypt certificate issued within the last 30 days, and operates under a Wix Studio subdomain—common among fast-flux phishing campaigns launched in bulk. The absence of prior blocklist entries and the low detection ratio suggest adversaries are testing new lure pages against security vendors before scaling traffic via social engineering. If you accidentally visited ext-exxodus.wixstudio.com or connected a wallet to the page, immediately revoke any token-approval transactions in your wallet settings and disconnect the site. Do not approve additional signing requests. Report the domain to your browser’s safe-browsing program and scan connected wallets with reputable tools such as revoke.cash or Etherscan’s token approval checker. Treat any funds already drained as lost; file incident reports with local cybercrime units and your wallet provider.