en-exdsweb[.]wixstudio[.]com

PhishDestroy identifies en-exdsweb.wixstudio.com as an active cryptocurrency drainer phishing page. The site mimics a legitimate web3 service in an effort to trick visitors into connecting crypto wallets and approving malicious token transfers. With 3 out of 95 VirusTotal security vendors already flagging the domain, this threat is not theoretical—it is producing real-world thefts every day.

This domain resolves to the IP address 34.144.206.118 and is currently hosted on Wix’s infrastructure. According to passive DNS data, the domain was first observed on the open web in late June 2024; the SSL certificate protecting the connection was issued by Let’s Encrypt on the same day, indicating the attackers rapidly deployed a TLS layer to appear legitimate. Registrar records show the domain was created only days before it began redirecting victims, a classic fast-flux tactic that helps evade traditional blocklists. Security blocklists from multiple vendors already include this domain, yet the page remains accessible, underscoring why manual verification is critical.

If you visited en-exdsweb.wixstudio.com, immediately disconnect your wallet from any dApps or websites and check your transaction history for any suspicious token approvals or outgoing transfers. Revoke any unauthorized permissions using tools like revoke.cash or similar services, and scan your device with up-to-date antivirus software. Report the incident to your wallet provider and local cybercrime unit, and never reuse the same seed phrase or private key on any site you did not personally verify. When in doubt, use PhishDestroy’s real-time link checker to confirm a domain’s safety before interacting—because in the world of crypto, one click can mean the loss of your entire portfolio.