more-lace[.]wixstudio[.]com

This domain, more-lace.wixstudio.com, is identified as a phishing resource targeting cryptocurrency users through brand impersonation. Analysis indicates the site mimics the Lace Wallet Extension, a legitimate Web3 wallet interface, as evidenced by the page title 'Lace Wallet Extension – Explore Web3.' The objective appears to be credential harvesting or crypto asset theft, though no specific drainer kit signatures were confirmed in initial scans. The use of a subdomain under a legitimate hosting provider suggests an attempt to evade detection while leveraging trusted infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 34.144.206.118, with a valid SSL certificate issued by Let's Encrypt. The domain was registered through GoDaddy.com, LLC, though no precise creation date was publicly accessible. Detection metrics show 4 out of 95 security vendors on VirusTotal flagged the domain as malicious. Additionally, the domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Google Safe Browsing status was not explicitly provided, but the presence on multiple blocklists corroborates the elevated risk assessment. As of the latest verification, the domain has been taken offline, likely in response to abuse reports or automated takedown mechanisms. Despite its current inactive status, residual risk persists due to potential rehosting or reuse of the phishing kit on other domains. Users who interacted with the site prior to takedown may remain vulnerable to credential replay attacks or wallet compromise. Recommended actions include revoking any permissions granted to the site, rotating credentials for associated accounts, and monitoring for unauthorized transactions. Organizations are advised to update blocklists with the identified indicators of compromise to prevent future exposure.