nav-cucoin[.]wixstudio[.]com

PhishDestroy identifies nav-cucoin.wixstudio.com as an active crypto drainer impersonating the legitimate CuCoin cryptocurrency exchange. This domain leverages a spoofed interface to trick users into connecting their crypto wallets, with the malicious payload designed to drain funds upon authorization. The threat vector aligns with modern crypto drainer kits that exploit wallet-connect permissions to initiate unauthorized transfers without user interaction. The infrastructure behind this campaign is hosted on a WixStudio subdomain, which adds a layer of legitimacy at first glance but masks the underlying malicious intent. Security researchers should treat this as a high-risk domain pending further behavioral analysis of the drainer payload.

Technical indicators for nav-cucoin.wixstudio.com reveal a concerning lack of detection, with VirusTotal currently showing 3/95 security engines flagging the domain as malicious. The site resolves to IP address 34.144.206.118, a Google Cloud Platform (GCP) IP allocated to a US-based subnet. The domain utilizes a Let's Encrypt SSL certificate, which provides a false sense of security by displaying HTTPS in the browser address bar. While the exact creation date remains unverified in public WHOIS records, the domain's recent emergence correlates with active phishing campaigns targeting CuCoin users. The current blocklist coverage is minimal, with no entries in major threat intelligence platforms, indicating this domain remains under the radar of most automated defenses.

This domain is currently active and under investigation by PhishDestroy's threat intelligence team. Immediate response actions include blocking the domain at network and endpoint levels, and coordinating takedown requests with the hosting provider (Wix.com) and SSL certificate authority (Let's Encrypt). The remaining risk is classified as high due to the domain's low detection rate and the irreversible nature of crypto drainer attacks. Users who have interacted with this domain should immediately revoke any connected wallet permissions and transfer remaining assets to a clean wallet. Security teams are advised to monitor for related infrastructure and update detection rules to include this domain and its associated IP address.