enwebexudus[.]wixstudio[.]com

PhishDestroy identifies enwebexudus.wixstudio.com as an active crypto credential theft domain masquerading as a cryptocurrency service portal. The site is engineered to harvest wallet passphrases, private keys, and seed phrases directly from unwitting users, redirecting funds to attacker-controlled addresses under the guise of legitimate authentication steps. Blocked by MetaMask’s extension defenses and SEAL’s threat intelligence pipeline, the domain bypasses initial detection layers, highlighting its potential for silent compromise. Traffic analysis reveals the infrastructure resolves to Google Cloud IP 34.144.206.118, secured by a Let’s Encrypt SSL certificate to bolster perceived legitimacy.

This domain entered circulation recently and has already been listed on 2 global security blocklists, indicating rapid propagation through spam campaigns and social media impersonation. VirusTotal analysis shows zero detections across 95 engines as of the latest scan, reflecting delayed signature updates and the domain’s use of legitimate hosting (WixStudio) to evade basic reputation filters. The combination of low detection, active blocking by two major security platforms, and the presence of a fresh SSL certificate suggests a sophisticated setup designed to target crypto users during high-impact events such as airdrop claims or exchange logins.

Users who accessed this domain should immediately inspect browser session storage and wallet extensions for unauthorized connections or injected scripts. Revoke any permissions granted to crypto services linked to this domain via tooling such as revoke.cash or Etherscan’s approval tracker. If credentials or private keys were entered, migrate assets to a new wallet with a different seed phrase and enable hardware wallet signing where possible. Report wallet addresses used in transactions to relevant blockchain explorers and consider enabling transaction simulation tools to block future outflow attempts.