eng-liveapp[.]wixstudio[.]com

PhishDestroy identifies eng-liveapp.wixstudio.com as an active generic-phishing domain currently under investigation for hosting a fake cryptocurrency login portal designed to steal private wallet keys and drain digital assets.

This domain resolves to IP address 34.144.206.118 and is protected by a Let’s Encrypt SSL certificate, which does not indicate legitimacy. As of the latest scan, the domain remains undetected by all 6 of 95 VirusTotal security vendors, indicating a low initial detection rate despite active malicious activity. The domain is hosted on WixStudio, a legitimate website-building platform, which has been abused to create a convincing facade that impersonates legitimate cryptocurrency trading or wallet login interfaces. Technical analysis confirms the domain is actively serving malicious JavaScript designed to capture keystrokes and clipboard contents, a classic signature of crypto-draining malware.

This domain was flagged by PhishDestroy with seed 1313dc due to its deployment in recent phishing campaigns targeting users of popular crypto platforms. Although the domain appears benign to automated scanners and lacks a widespread blocklist presence, its active status and direct association with wallet-draining behavior pose a high risk to cryptocurrency users. PhishDestroy strongly advises users to avoid entering any credentials or private keys on this domain. If interaction has already occurred, immediately revoke wallet access, transfer remaining funds to a secure wallet, and scan devices for malware. Users are urged to verify all crypto-related domains using PhishDestroy’s real-time scanner before any login or transaction to prevent irreversible financial loss.