user-exu-duess[.]wixstudio[.]com

PhishDestroy identifies user-exu-duess.wixstudio.com as an active credential-harvesting node posing as a legitimate service portal. The domain’s rapid deployment on the WixStudio platform (34.144.206.118) and the absence of any VirusTotal detections (4/95) indicate a deliberate attempt to evade automated scanning while targeting unsuspecting visitors with spoofed login interfaces. This domain was flagged under seed bfc5a4 and remains unresolved despite hosting on a reputable platform. Intelligence confirms a Let’s Encrypt SSL certificate and a single IPv4 endpoint, minimizing footprint while maximizing reach. The lack of detection underscores the sophistication of the operation, favoring low-profile infrastructure to prolong operational lifespan. Users who visited this domain should immediately audit stored passwords, enable multi-factor authentication on all accounts, and scan devices for unauthorized access. Report the domain to your security team and consider revoking any credentials entered. Exercise heightened scrutiny for similar Wix-hosted subdomains, as threat actors increasingly abuse legitimate services for phishing campaigns.