appsstart-ex-odus[.]wixstudio[.]com

The domain appsstart-ex-odus.wixstudio.com has been identified as part of an active generic phishing campaign suspected to distribute a cryptocurrency asset drainer. The infrastructure leverages a fabricated subdomain under wixstudio.com, a legitimate hosting platform, to lend superficial credibility to the fraudulent content. No specific brand impersonation or drainer kit signature has been confirmed at this stage; however, the domain’s naming convention suggests an attempt to mimic or parody legitimate cryptocurrency-related services, likely targeting users through social engineering or misleading links. The use of a rapid-prototype hosting environment indicates operational agility aimed at evading detection prior to widespread abuse.

Infrastructure analysis reveals the domain resolves to IPv4 address 34.144.206.118 and was first registered on December 17, 2016, through GoDaddy.com, LLC. As of the latest assessment, VirusTotal detection remains at 0 out of 95 engines, with no flags from Google Safe Browsing or known third-party blocklists. The domain’s age and neutral hosting profile contrast with its current malicious intent, suggesting either recent compromise of the subdomain or deliberate long-term registration to maintain access to a clean IP reputation history. The absence of detections highlights a potential gap in heuristic detection mechanisms targeting crypto-draining behaviors on legitimate hosting infrastructures.

This domain is currently active and remains unblocked across major threat intelligence platforms. Given the lack of detection coverage and the domain’s plausible deniability due to hosting on a reputable platform, the immediate risk to end users is elevated. Users accessing links associated with this domain risk exposure to unauthorized cryptocurrency transactions facilitated by embedded drainer scripts. Immediate actions should include domain blocking at network gateways using the IP and domain indicators, monitoring for drainer signatures in web traffic, and updating browser-based detection rules. While the current risk is classified as under investigation, the absence of proactive defenses increases the likelihood of successful exploitation. Continued monitoring is required to assess the development and deployment of drainer logic on this infrastructure.