withdrawconnect[.]wixsite[.]com

This domain, withdrawconnect.wixsite.com, operates as a fraudulent cryptocurrency withdrawal portal designed to harvest login credentials and private wallet keys. Analysis indicates the site mimics legitimate exchange withdrawal interfaces, tricking users into entering sensitive authentication details or approving malicious transactions. The infrastructure is optimized for rapid credential collection before takedown, with automated scripts likely processing stolen data in real time. Infrastructure analysis reveals the domain was created on April 08, 2026, through Wix's hosting platform. Security vendors flagged the site in 9 of 95 VirusTotal engines, while independent blocklists confirm its presence on at least one high-confidence threat feed. The domain resolves to IP address 34.144.206.118 and uses a Let's Encrypt SSL certificate to appear legitimate. Despite its current offline status, historical DNS records suggest it may have been active for several days before detection. Users who interacted with withdrawconnect.wixsite.com should immediately revoke any connected wallet permissions and transfer assets to a new secure wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Browser data should be cleared to remove any stored credentials, and security software should perform a full system scan to detect potential secondary infections. Organizations should add the domain and associated IP to internal blocklists to prevent future access attempts.