apps-ettoro-us[.]wixstudio[.]com

PhishDestroy identifies the domain apps-ettoro-us.wixstudio.com as an ACTIVE fake eToro trading portal designed to harvest user credentials and financial data. The page mimics the legitimate eToro platform to trick victims into entering their login details, exposing accounts to theft and unauthorized trades. This is a credential-phishing attack, not generic phishing, with a clear intent to steal authentication data for financial fraud.

The threat is supported by multiple technical indicators. VirusTotal currently scores the domain at 4/95 detections, indicating it has not yet been flagged by most antivirus engines. The site resolves to IP 34.144.206.118, a Google Cloud Platform address commonly used for short-lived phishing campaigns. The SSL certificate is issued by Let’s Encrypt, a trusted provider often abused by threat actors to lend legitimacy to malicious sites. The domain is hosted on Wix Studio, a legitimate site builder exploited to rapidly deploy fraudulent pages. As of seed 3cf435, no public blocklists or trust scores (e.g., from OpenPhish, PhishTank, or Google Safe Browsing) currently list this domain, allowing it to operate undetected.

Users should immediately avoid accessing apps-ettoro-us.wixstudio.com and report it to their email provider, browser, and the legitimate eToro security team. If credentials were entered, users must change passwords immediately, enable two-factor authentication, and monitor accounts for unauthorized activity. Organizations should block the IP 34.144.206.118 and domain at the network perimeter. Security teams are advised to scan logs for any connections to this domain and update email filtering rules to detect future variants. Proactive takedown requests should be submitted to Wix and hosting providers using the seed reference 3cf435 for faster processing.