ethstudio[.]top

This domain, ethstudio.top, operates as a crypto credential theft platform designed to harvest wallet login credentials through a fraudulent CODE COMPILER interface. Analysis indicates the site mimics legitimate development environments to trick users into entering sensitive wallet information, which is then captured for unauthorized fund transfers or account takeovers. The threat specifically targets cryptocurrency users, leveraging social engineering tactics to exploit trust in coding tools and development platforms. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with additional detections in 2 AlienVault OTX threat intelligence pulses. It appears on 4 security blocklists and is currently blocked by multiple wallet security providers. Registered through NameSilo, LLC on June 13, 2026, the domain resolves to IP address 37.120.239.34 and uses a Let's Encrypt SSL certificate. Technical stack includes Node.js, Nginx, and Cloudflare, suggesting sophisticated infrastructure designed to evade detection. Users who visited ethstudio.top should immediately revoke any wallet permissions granted during the interaction and transfer assets to a new secure wallet. All credentials entered on the site should be considered compromised, requiring password resets for associated accounts. Monitor transaction histories for unauthorized activity and report any suspicious transfers to relevant blockchain explorers. The domain's current offline status does not eliminate the risk to previously exposed credentials, necessitating proactive security measures for affected users.