acc-binaes[.]wixstudio[.]com

PhishDestroy identifies acc-binaes.wixstudio.com as an active crypto-draining scam site that impersonates the global cryptocurrency brand Binance. This Wix-hosted page (acc-binaes.wixstudio.com) is designed to steal cryptocurrency by luring users into connecting crypto wallets under the pretense of token distributions, staking rewards, or account verifications. The threat actor leverages the lookalike subdomain and Binance brand trust to trick victims into signing malicious wallet transactions that drain funds directly into attacker-controlled addresses. No custom drainer kit signature has been extracted yet; the payload appears to be dynamically injected via a JavaScript-based web3 library loaded from a third-party CDN. This domain exhibits multiple technical hallmarks of a generic phishing operation. VirusTotal currently reports a clean score of 0 detections out of 95 scanners, indicating evasion against signature-based defenses. It resolves to IP 34.144.206.118 on Google Cloud Platform, which is consistent with abuse-resistant cloud hosting to prolong campaign uptime. The domain was created recently and is registered through Wix.com as the registrar and hosting provider, enabling rapid deployment and low-cost operations. Google Safe Browsing (GSB) has not yet flagged the domain, aligning with its low detection profile. Cross-referencing blocklist aggregators shows zero inclusion, suggesting this campaign remains in its early propagation phase. The domain remains active and continues to serve the Binance impersonation page aimed at cryptocurrency theft. PhishDestroy has flagged it as “under investigation” and assigned a unique seed identifier (4b231f) to track lateral movement across vectors. Immediate risk to users is moderate due to low VT coverage and absence from major blocklists, enabling prolonged exposure. Recommended actions include blocking the IP 34.144.206.118 at network firewalls and adding the full domain to enterprise and personal blocklists. Users are strongly advised to verify any Binance-related links using PhishDestroy’s real-time scanner before entering credentials or connecting wallets. Remaining risk is elevated due to the domain’s current clean status and its alignment with widespread crypto drainer tactics targeting Binance customers globally.