web3exoqus[.]wixstudio[.]com

This domain is flagged as a cryptocurrency credential phishing site with an elevated risk level. Analysis indicates it was designed to harvest login details, seed phrases, or private keys from users under the guise of a Web3 or decentralized finance service. Despite currently displaying a 404 error page, the domain’s infrastructure and prior activity align with known phishing patterns targeting digital asset holders. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 14, 2026, and resolves to the IP address 34.144.206.118. It is detected by 4 out of 95 security vendors on VirusTotal, with active listings on three blocklists: PhishDestroy, PhishingArmy, and OISD. The site employs technologies including Wix, React, Google Cloud, and Google Cloud CDN, with an SSL certificate issued by Let’s Encrypt. The discrepancy between the 404 error page and its presence on multiple threat intelligence feeds suggests the domain was either taken down post-compromise or is in a dormant phase awaiting reactivation. Mitigation steps include blocking the domain and its resolving IP (34.144.206.118) at the network perimeter, particularly in environments handling cryptocurrency transactions. Security teams should monitor for connections to this IP or domain in proxy logs, endpoint detection and response (EDR) telemetry, and DNS query records. Given the elevated risk, affected organizations are advised to reset credentials for any accounts that may have interacted with the domain and review transaction histories for unauthorized activity. Additionally, user awareness training should emphasize the risks of interacting with unverified Web3 or cryptocurrency-related sites, even those hosted on seemingly legitimate platforms like Wix Studio.