exxnsx[.]top

PhishDestroy identifies exxnsx.top as a live crypto-draining page posing as the Exness Pro trading interface. This domain’s landing page is designed to trick cryptocurrency traders into connecting Web3 wallets so malicious scripts can divert funds to attacker-controlled addresses. The page displays the familiar Exness Pro branding and interface elements, but under the hood it loads wallet-draining JavaScript delivered from 143.92.60.42, a server recently provisioned by the threat actor. This domain was flagged by PhishDestroy on discovery of its active crypto-draining payload. VirusTotal currently shows 0 detections out of 95 engines, indicating a low AV coverage window that threat actors routinely exploit. The domain was registered through NameSilo, LLC on March 10, 2026, just days before the campaign went live, and its Let’s Encrypt SSL certificate provides a veneer of legitimacy. WHOIS data is privacy-protected, further obscuring the true registrant. Network telemetry places the resolving IP, 143.92.60.42, in a recently allocated netblock with no prior reputation, reinforcing the conclusion that this infrastructure exists solely to serve malicious payloads. If you visited exxnsx.top and connected a wallet, immediately revoke the connected permissions via your wallet provider’s connection management dashboard. Disconnect the site and remove any associated approvals for the domain. Do not approve any further transaction prompts that may appear. If you entered any credentials or private keys, consider those compromised and move remaining funds to a new, clean wallet. Report the domain to your security team or via PhishDestroy’s submission portal so it can be added to blocklists and prevent future visitors from falling victim.