exduos-connect[.]wixstudio[.]com

PhishDestroy identifies active brand impersonation activity targeting Exodus users via the domain exduos-connect.wixstudio.com. This fraudulent WixStudio-hosted page masquerades as a legitimate Exodus connectivity portal, likely embedding a crypto drainer kit designed to siphon digital assets from victims who input wallet credentials or connect wallet extensions. The infrastructure choice (WixStudio) and SSL certificate (Let's Encrypt) suggest low-cost, high-reach deployment aimed at casual detection evasion. While no specific drainer kit signature has been recovered, the page’s branding and call-to-action (“connect”) closely mirror official Exodus language, increasing potential victim engagement.

This domain was flagged during routine monitoring with technical indicators as follows: VirusTotal detection ratio is 4/95 engines as of latest scan, indicating zero antivirus coverage; the domain resolves to IP 34.144.206.118 (Google Cloud, U.S.); no publicly documented creation date is available, suggesting recent registration; Google Safe Browsing has not yet marked the domain as malicious; and it remains unlisted on major threat intelligence blocklists. The use of a reputable hosting provider (Wix) and CDN (Google Cloud) complicates takedown efforts and increases operational resilience.

As of this report, the campaign remains active with low signature detection and no active takedown actions observed. The risk level is classified as under investigation, but the absence of detections and the targeting of a major crypto brand elevate the threat to high potential impact. Users are advised to block exduos-connect.wixstudio.com at the DNS level, avoid clicking any links referencing “exduos-connect” or similar misspellings of Exodus, and verify all wallet connection URLs directly via official Exodus channels. Remaining risk includes continued deployment of new subdomains under wixstudio.com, potential drainer version updates, and expansion to other crypto brands. Immediate community and vendor alerts have been dispatched to disrupt propagation.