xodus-web3[.]wixstudio[.]com

The domain xodus-web3.wixstudio.com has been identified as a crypto drainer phishing site, designed to illicitly extract cryptocurrency assets from victims through deceptive interactions. Currently, the domain is offline, returning a 404 error page hosted on a Wix Studio platform. No direct brand impersonation is evident from the available data, but the domain’s structure and naming convention suggest an intent to mimic legitimate Web3 or decentralized finance services to exploit user trust. Analysis indicates this domain was flagged by 16 of 95 security vendors on VirusTotal, reflecting a high level of consensus regarding its malicious nature. The domain resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with technologies including Envoy, React, and Google Cloud CDN. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Registered through GoDaddy.com, LLC, the domain was created on April 15, 2026, an anomalous future date that may indicate falsified registration details or a system error. The domain appears on five security blocklists, including MetaMask and PhishingArmy, further corroborating its classification as a threat. Infrastructure analysis reveals the use of HTTP/3, a modern protocol that can complicate detection and mitigation efforts due to its encrypted-by-default nature. Given the domain’s current offline status, immediate threats to end-users are mitigated; however, the infrastructure remains a potential vector for future malicious activity. Organizations and individuals are advised to maintain blocklist entries for this domain and its associated IP address to prevent re-emergence. Users who may have interacted with the domain should audit their cryptocurrency wallets for unauthorized transactions and revoke any suspicious smart contract approvals. Security teams are encouraged to monitor for similar domains leveraging Wix Studio or Google Cloud infrastructure, particularly those with Web3-related naming conventions. Proactive measures, such as deploying network-level filters and educating users on crypto drainer tactics, are recommended to reduce exposure to such threats.