en-exodasweb[.]wixstudio[.]com

This domain, en-exodasweb.wixstudio.com, has been identified as a crypto drainer phishing site targeting users through deceptive web interfaces designed to siphon cryptocurrency assets. As of the latest verification, the domain is offline, though prior activity indicates it was actively used in malicious campaigns. The site impersonated legitimate cryptocurrency services to trick victims into connecting wallets, enabling unauthorized transactions. Analysis indicates the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on infrastructure leveraging Wix, Envoy, React, Google Cloud, and Google Cloud CDN. The SSL certificate was issued by Let’s Encrypt, a common practice among threat actors to mimic legitimacy. Security vendors flagged the domain in 14 of 95 VirusTotal detections, while three independent security blocklists listed it as malicious. Additional scrutiny reveals a Gridinsoft trust score of 0/100, further confirming its high-risk classification. The page title, '404 Error: Page Not Found | Wix Studio,' suggests either a takedown or deliberate obfuscation of its original malicious content. Given the domain’s current offline status, the immediate threat appears mitigated; however, historical activity warrants caution. Organizations and individuals are advised to block the domain and its associated IP (34.144.206.118) at the network level. Users should verify wallet connections before interacting with any cryptocurrency-related service and enable multi-factor authentication where available. Security teams are encouraged to monitor for resurgence under similar domains or hosting providers, as threat actors frequently reuse infrastructure patterns.