explore-exodos-learn[.]wixstudio[.]com

The domain explore-exodos-learn.wixstudio.com has been identified as a fake login portal designed to harvest credentials through deceptive authentication interfaces. Analysis indicates this is not a generic phishing attempt but a targeted fake login scheme, likely impersonating legitimate Wix Studio login pages to trick users into entering sensitive account information. The domain is currently offline, though prior activity suggests it was actively used for credential theft operations. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on April 30, 2026, with an SSL certificate issued by Let's Encrypt. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with React and HTTP/3 technologies detected. Security vendors have flagged this domain at a rate of 13 out of 95 on VirusTotal, while Gridinsoft assigned a trust score of 0 out of 100. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, confirming its malicious classification. The 404 error page currently displayed is consistent with post-compromise takedown behavior, where threat actors abandon infrastructure after detection. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with it during its active phase. Organizations should implement DNS-based blocking for this domain and its associated IP address 34.144.206.118. Users who accessed the site should immediately reset credentials for any accounts entered, particularly those associated with Wix or other web development platforms. Security teams are advised to monitor for similar patterns in subdomains using the wixstudio.com namespace, as this appears to be a recurring vector for credential harvesting campaigns. The creation date discrepancy (2026) suggests either a registration error or deliberate attempt to evade temporal analysis, warranting additional scrutiny of domains with anomalous timestamps.