studio-en-exdous[.]wixstudio[.]com

This domain, studio-en-exdous.wixstudio.com, is flagged for brand impersonation targeting Exodus, a cryptocurrency wallet provider. The site mimics the official Exodus Web3 Wallet and browser extension, as evidenced by the page title 'Exodus® Web3 Wallet | Exodus® Browser Extension.' No direct evidence of a crypto drainer kit was observed, but the impersonation suggests intent to harvest credentials or distribute malicious payloads under the guise of legitimate software.

Analysis indicates the domain was registered through GoDaddy.com, LLC on December 17, 2016, though recent activity suggests compromise or repurposing for malicious use. It resolves to IP address 34.144.206.118 and is associated with a Let's Encrypt SSL certificate. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious. The domain appears on three blocklists: PhishDestroy, PhishingArmy, and OISD. No Google Safe Browsing (GSB) status is currently available, but the combination of blocklist presence and vendor detections confirms elevated risk.

As of the latest assessment, studio-en-exdous.wixstudio.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the infrastructure remains registered, and the domain could be reactivated or repurposed. Users who interacted with the site should assume credential exposure and revoke any associated wallet permissions. Organizations are advised to monitor for similar impersonation attempts using the same registrar or hosting provider, as this may indicate a broader campaign targeting cryptocurrency users.