enus-exodsu[.]wixstudio[.]com

PhishDestroy identifies enus-exodsu.wixstudio.com as a live phishing lure that masquerades as a legitimate login interface to trick users into surrendering sensitive credentials. This generic phishing page, detected under seed 73881c, is currently active and remains undetected by VirusTotal engines, showing 4 out of 95 detections. The domain resolves to the IP address 34.144.206.118, which hosts the landing page served via a Let’s Encrypt SSL certificate, indicating the operators are leveraging free certificates to boost perceived legitimacy and potentially evade inspection. While historical WHOIS records list Wix.com as the hosting platform, there are no confirmed blocklist entries or trust-score penalties at this time, underscoring the value of proactive domain blocking before detection engines catch up. Domain-specific telemetry confirms the page is operational and designed to harvest usernames and passwords under false pretenses, with no legitimate business purpose apparent from open-source intelligence. The current risk level is rated under_investigation, reflecting ongoing monitoring rather than dismissal; phishing lures frequently migrate across IP blocks and hostnames to avoid takedowns, so the absence of detections cannot be interpreted as safety. Users or organizations encountering this domain on internal logs, proxies, or endpoints should flag it immediately for further sandbox analysis and incident response. Mitigation against this domain centers on credential-harvesting prevention and reducing exposure to the infrastructure. Disable write access to browser credential stores on managed endpoints, enforce multi-factor authentication on all external portals, and configure email gateways to quarantine messages containing links to the domain. At the network layer, block both the hostname enus-exodsu.wixstudio.com and the resolved IP 34.144.206.118 via DNS sinkholing and firewall rules; rotate any credentials that may have been exposed via this campaign. Lastly, extract indicators from proxy logs for IOC enrichment and share with threat-intelligence platforms to accelerate detection rollout across the community.