en-ex-edues[.]wixstudio[.]com

PhishDestroy identifies en-ex-edues.wixstudio.com as an active generic phishing domain under investigation, potentially targeting academic credential theft systems. The domain leverages a WixStudio-hosted page to mimic legitimate educational portals, creating a facade for credential harvesting or crypto drainer deployment. No specific drainer kit has been confirmed via open-source intelligence, but the site’s structure suggests typical phishing toolkits like Evilginx or Modlishka may be in use. The threat actor’s goal appears to be harvesting login credentials from unsuspecting users by posing as an educational administration or course registration system.

Technical indicators confirm this domain’s malicious intent. VirusTotal currently scores it at 6/95 detections, indicating it remains undetected by most antivirus engines as of the latest scan. The domain resolves to IP 34.144.206.118, a Google Cloud Platform address commonly associated with dynamic phishing operations. The SSL certificate is issued by Let’s Encrypt, a free certificate authority often exploited by phishers to add superficial legitimacy. Registrar data shows it is hosted on Wix’s platform (wixstudio.com), a common choice for low-cost phishing page deployment. The domain’s creation date has not been publicly disclosed, and its status in Google Safe Browsing (GSB) remains unverified, while blocklist tracking suggests no prior listings at this time.

As of the latest update, the domain remains active with a status of 'under_investigation' by domain safety monitors. Immediate containment actions include GSB blacklisting, DNS sinkholing, and endpoint rule deployment to block access. Users are advised to avoid the domain entirely and report any suspicious interactions. The remaining risk is classified as moderate due to the domain’s recent activation and low detection rate, but active monitoring is in progress. No confirmed infections have been reported yet, but the potential for credential theft or malware delivery remains high if unchecked.