apps-exaduswebs[.]wixstudio[.]com

This domain, apps-exaduswebs.wixstudio.com, is identified as a credential phishing endpoint targeting users through deceptive login interfaces. Analysis confirms the domain is currently offline, though it previously hosted malicious content designed to harvest authentication credentials. No specific brand impersonation was confirmed, but the infrastructure and page behavior align with generic phishing campaigns. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating broad detection across multiple threat intelligence sources. It appears on five security blocklists, including MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD. The domain resolves to IP address 34.144.206.118, hosted on Google Cloud infrastructure, and was registered through GoDaddy.com, LLC. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains. Technologies detected include Wix, React, Google Cloud CDN, and HTTP/3, suggesting the use of modern web frameworks to evade detection. Gridinsoft assigned a trust score of 0/100, further validating its malicious classification. The domain is currently offline, though historical activity and detection metrics warrant continued monitoring. Organizations are advised to block the domain and its associated IP (34.144.206.118) at the perimeter. Security teams should review logs for connections to this domain or IP, particularly those occurring prior to its takedown. Endpoint protection and email filtering systems should be updated to include this domain in deny lists. If user credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.