ex-ouds-us[.]wixstudio[.]com

PhishDestroy identifies an active Exodus brand impersonation campaign leveraging the domain ex-ouds-us.wixstudio.com to deploy crypto-draining infrastructure targeting users of the Exodus wallet. The threat actor registered this domain under Wix’s studio hosting platform to mimic official Exodus branding, creating a high-fidelity lure intended to deceive cryptocurrency holders into surrendering credentials or seed phrases under the guise of technical support or security verification. This campaign employs a spoofed support interface and likely integrates a drainer kit designed to silently transfer assets from victim wallets upon interaction. No confirmed drainer kit payload has been retrieved yet, but behavioral analysis suggests real-time asset exfiltration mechanisms are in place. The campaign is currently classified under seed b50238 and remains under active investigation by multiple threat intelligence teams.

This domain resolves to IP 34.144.206.118 via a Let’s Encrypt SSL certificate and shows zero detections on VirusTotal (4/95 engines as of latest scan). The domain was registered through Wix.com under their Wix Studio platform and is associated with a recently created subdomain, suggesting opportunistic deployment. Google Safe Browsing (GSB) has not yet flagged this domain, and public blocklist coverage remains at zero entries across major threat intelligence feeds. WHOIS data indicates recent registration with privacy protection enabled, obscuring registrant details. Given the absence of AV detections and low blocklist coverage, this domain represents a high-risk, low-signature threat vector likely targeting users through email, social media, or fake support portals.

As of this report, the campaign is active and expanding, with no takedown or mitigation by hosting providers or security vendors. The lack of detections and blocklist entries indicates a window of opportunity for threat actors to operate undetected. Immediate user actions include verifying all support communications originate from official exodus.io domains, never entering seed phrases outside a verified local wallet app, and reporting suspicious domains to Exodus support and threat intelligence platforms. Organizations should deploy DNS filtering rules targeting wixstudio.com subdomains mimicking known brands and monitor outbound traffic to IP 34.144.206.118. Remaining risk is assessed as HIGH due to the combination of active deployment, low detection, and direct targeting of cryptocurrency users—where even a single successful interaction can result in total asset loss. Proactive threat hunting and domain intelligence sharing are critical to disrupt this campaign before it scales further.