exxdous-apps[.]wixstudio[.]com

Investigation into exxdous-apps.wixstudio.com has uncovered a crypto drainer kit hosted on Wix’s platform, designed to siphon cryptocurrency from unsuspecting victims. This domain leverages a generic naming convention mimicking legitimate crypto platform URLs, suggesting a deliberate attempt to impersonate established services in the Web3 ecosystem. While no specific drainer codebase was identified in initial scans, the domain’s structure and TLS configuration align with common redirection tactics observed in smishing and phishing campaigns targeting digital asset holders. The absence of cryptocurrency-related branding in the domain name is offset by the use of Wix’s subdomain service, which serves as a smokescreen for malicious infrastructure deployment, thereby bypassing some automated detection mechanisms.

Technical indicators reveal the domain resolves to a clean IP address (34.144.206.118) currently associated with 4/95 VirusTotal detections as of the latest scan. The domain was registered through Wix’s studio platform, obscuring the underlying registrar details but confirming hosting on Wix infrastructure. The SSL certificate, issued by Let’s Encrypt, appears valid at first glance, though its fresh issuance date and short validity period warrant further scrutiny. No historical data regarding the domain’s creation date is available due to Wix’s platform obscuration, and Google Safe Browsing (GSB) has not yet flagged the domain. Preliminary DNS and WHOIS queries show no prior associations with known malicious campaigns, but the lack of telemetry suggests either a nascent threat or one designed to evade early detection. Additional forensics are required to determine the drainer’s payload distribution method, such as malicious ads or phishing emails linking to this domain.

The domain remains active and under active investigation, with no immediate takedown action taken due to Wix’s hosting policies and the domain’s low current detection rate. SOC teams are advised to block both the domain and its resolved IP (34.144.206.118) at the network perimeter to mitigate potential exposure. While the risk level is currently rated as “under_investigation,” the threat actor’s choice of a reputable hosting provider and cryptocurrency-adjacent naming convention poses a moderate risk to users engaging with Web3 platforms. Continuous monitoring of this domain for changes in SSL certificates, subdomain creation, or payload delivery shifts is critical. Security personnel should also audit internal logs for any outbound connections to this IP or domain, particularly from endpoints handling cryptocurrency transactions. Given the domain’s active status and the potential for rapid escalation in detection rates, immediate containment actions are strongly recommended to prevent financial losses among users.