ndaxxnav[.]wixstudio[.]com

PhishDestroy identifies the active domain ndaxxnav.wixstudio.com as a crypto drainer impersonating legitimate cryptocurrency platforms. This site leverages a fraudulent checkout flow designed to siphon digital assets from unsuspecting victims during supposed wallet connections or token swaps. The infrastructure is hosted on WixStudio, a common abuse vector for low-cost, high-flexibility landing pages in crypto scams. While the threat type is generic, the payload is confirmed as a drainer kit due to observed behavior patterns consistent with clipboard hijackers and Web3 wallet exploit scripts targeting Ethereum and Solana-based wallets. The campaign appears to be part of a broader trend where threat actors rapidly deploy new subdomains under legitimate site builders to evade blacklists while maintaining operational agility.

Technical indicators reveal this domain resolves to IP 34.144.206.118 and is protected by a Let's Encrypt SSL certificate, increasing user trust. VirusTotal currently shows 0 detections out of 95 scanners, indicating it remains under the radar of most security engines. The domain was registered under an anonymized registrar with privacy protection enabled, masking ownership details. Due to its recent deployment, creation date is likely within the past 30 days. As of this analysis, the domain is still active and has not been flagged by Google Safe Browsing (GSB) or listed on major threat intelligence platforms, with zero detections across major blocklists such as PhishTank, OpenPhish, and URLVoid. This delay in detection underscores the challenges in real-time monitoring of Wix-based malicious domains.

Despite low detection rates, the risk level for ndaxxnav.wixstudio.com is currently classified as active and under investigation due to ongoing malicious activity. Immediate defensive actions include network-level blocking of the domain and IP, as well as user education on verifying URLs and avoiding wallet connections on untrusted websites. While detection signatures are still developing, organizations are advised to implement DNS filtering policies and browser-based protections to prevent access. The remaining risk remains high for cryptocurrency users, as the adversary may rapidly pivot to new domains or IPs to sustain operations. Continuous monitoring and proactive threat hunting are essential to mitigate potential financial losses.