exadusweb-apps[.]wixstudio[.]com

The domain exadusweb-apps.wixstudio.com is identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain is currently offline, though it previously operated under the guise of a legitimate service to extract sensitive authentication details. No specific brand impersonation was confirmed, but the infrastructure and techniques align with credential theft campaigns. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118. It was flagged by 14 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on one security blocklist and employed technologies including Wix, React, Google Cloud, and Let’s Encrypt SSL certificates. Detection counts and trust scores underscore its elevated risk classification, despite its current inactive status. The domain has since been taken offline, likely due to enforcement actions or hosting provider intervention. Organizations and users are advised to block the domain and associated IP address at the network level. Security teams should monitor for similar patterns, such as Wix-hosted subdomains with anomalous login pages, and ensure endpoint protection systems are updated to detect credential harvesting attempts. Historical logs should be reviewed for interactions with 34.144.206.118 or exadusweb-apps.wixstudio.com to assess potential exposure.