started-eng-exadus[.]wixstudio[.]com

PhishDestroy identifies started-eng-exadus.wixstudio.com as an active crypto drainer impersonating a legitimate exchange platform. The domain operates under a medium risk classification, with current intelligence confirming SSL encryption via Let's Encrypt and resolution to IP 34.144.206.118. This site is designed to deceive users into connecting cryptocurrency wallets, enabling unauthorized fund transfers under the guise of legitimate authentication processes. This domain was flagged as a generic phishing site with a current risk level marked as under_investigation. Technical indicators include a VirusTotal scan result of 0 detections out of 95 engines, indicating a low immediate detection rate despite clear malicious intent. The domain operates on WixStudio hosting, resolving to IP 34.144.206.118, which is associated with cloud infrastructure commonly exploited by threat actors. Notably, the SSL certificate is issued by Let's Encrypt, a trusted provider often misused to lend legitimacy to fraudulent sites. At the time of analysis, the domain remains unlisted on major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish, increasing the risk of exposure to unsuspecting users. Domain registration details remain concealed, a common tactic among malicious actors to hinder takedown efforts. The primary threat posed by started-eng-exadus.wixstudio.com is crypto drainer phishing, where victims are lured into connecting their wallets under false pretenses, resulting in immediate fund extraction. This domain leverages a professional facade, likely mimicking a well-known exchange or trading interface to enhance credibility. Given the lack of detections on VirusTotal and absence from major blocklists, the window for user exposure remains significant. Mitigation requires immediate domain blocking at the network and endpoint levels, alongside user education on verifying site authenticity via official channels. Organizations should deploy threat intelligence feeds to monitor for similar domains and update firewall rules to restrict access. Users encountering this domain should report it to their wallet provider and avoid any interaction, including wallet connections or data input.