exadus-my[.]wixstudio[.]com

PhishDestroy identifies exadus-my.wixstudio.com as a credential harvesting phishing domain actively targeting users through a Wix-hosted page. The domain leverages a Let's Encrypt SSL certificate to appear legitimate, resolving to IP 34.144.206.118. With zero detections on VirusTotal and no existing blocklist flags, this threat remains under investigation but poses significant risk due to its sophisticated impersonation tactics, particularly in mimicking login portals to steal credentials.

Technical indicators confirm the domain's malicious intent: VirusTotal currently reports 0/95 detections, indicating it evades most antivirus engines. The domain is hosted on Wix's infrastructure, which is frequently abused by threat actors to rapidly deploy phishing pages. While the exact creation date of exadus-my.wixstudio.com is not publicly disclosed, its use of a Let's Encrypt certificate suggests recent deployment, as such certificates are typically short-lived. The absence of detections and blocklist entries highlights the challenge of early-stage phishing detection, as threat actors continuously refine evasion techniques to bypass security controls.

Users who visited exadus-my.wixstudio.com should immediately check their accounts for unauthorized access, especially if credentials were entered. Even if no interaction occurred, the domain's SSL certificate indicates it was operational recently. Report the domain to your email provider or security team and avoid future visits. Enable multi-factor authentication on all accounts to mitigate credential theft risks. If credentials were entered, change passwords immediately and monitor for suspicious activity. For further analysis, refer to PhishDestroy's full investigation report.