exod-us-org[.]wixstudio[.]com

PhishDestroy identifies exod-us-org.wixstudio.com as an active brand impersonation threat mimicking the Exodus cryptocurrency wallet to harvest user credentials and funds. This malicious domain leverages a legitimate WixStudio subdomain (wixstudio.com) to appear authentic while hosting phishing content designed to trick victims into entering sensitive wallet recovery phrases or private keys. The infrastructure behind this domain is hosted on a Google Cloud IP (34.144.206.118) and secured with a Let's Encrypt SSL certificate, which may further deceive users into believing the site is legitimate. Already flagged by two security blocklists and blocked by SEAL and MetaMask, this domain remains undetected by 95 VirusTotal scanners, highlighting the need for proactive threat intelligence.

This investigation reveals critical indicators that confirm the malicious intent of exod-us-org.wixstudio.com. The domain currently shows 0 detections out of 95 VirusTotal scans, indicating it has evaded most automated detection systems. The domain resolves to a Google Cloud IP (34.144.206.118) and uses a Let's Encrypt SSL certificate, which can lull users into a false sense of security. It has been flagged by two security blocklists and is explicitly blocked by SEAL and MetaMask, demonstrating its malicious nature. While the exact creation date is unverified, the combination of these factors—particularly the undetected status on VirusTotal and active blocking by security tools—confirms this is a high-risk brand impersonation campaign targeting Exodus users.

Users who have visited exod-us-org.wixstudio.com should immediately cease any interaction with the site and check their cryptocurrency wallets for unauthorized transactions or suspicious activity. If you entered your Exodus wallet recovery phrase or private keys on this domain, assume your funds are at risk and transfer remaining assets to a secure, offline wallet immediately. Revoke any API keys or permissions granted to this site and reset passwords for associated email accounts. Report the domain to Exodus support and your local cybersecurity authorities. To prevent future exposure, avoid clicking links in unsolicited emails or messages and verify website URLs carefully before entering sensitive information.