exadusweb[.]wixstudio[.]com

PhishDestroy identifies exadusweb.wixstudio.com as an active credential theft scam designed to harvest user login credentials under the guise of a legitimate service. This domain leverages a WixStudio subdomain to appear authentic, deceiving visitors into submitting sensitive information that attackers exploit for unauthorized access to accounts and financial profiles. The malicious infrastructure resolves to 34.144.206.118 and uses a Let’s Encrypt SSL certificate to enhance credibility, making it harder for users to detect the deception. This campaign specifically preys on trust in web hosting platforms and impersonates service interfaces to trick victims into surrendering credentials. This domain was flagged with 0 detections out of 95 VirusTotal scans, indicating low detection by automated tools. Infrastructure analysis shows it is hosted on a Google Cloud IP (34.144.206.118) and secured with a Let’s Encrypt certificate issued for broader legitimacy. The subdomain structure (wixstudio.com) is exploited to mimic professional hosting services. Users should avoid interacting with this domain entirely. Blocking the domain and IP at the network level is strongly recommended to prevent accidental exposure. If you have visited exadusweb.wixstudio.com or entered credentials, immediately change passwords on all accounts using the same email or username. Enable multi-factor authentication where available. Scan devices for malware and monitor accounts for suspicious activity such as unauthorized logins or transactions. Report the domain to your IT security team and file a complaint with relevant authorities like the FTC or local cybercrime units. Never reuse passwords across platforms—use a password manager to generate and store unique credentials securely.