logon-smart[.]wixstudio[.]com

PhishDestroy identifies logon-smart.wixstudio.com as an active crypto drainer campaign hosting a fake login page designed to steal cryptocurrency wallet credentials and drain digital assets. The site mimics a legitimate login portal, luring users into entering sensitive wallet information under the guise of a routine authentication request. Threat actors leverage the trusted Wixstudio subdomain to bypass initial suspicion, increasing the likelihood of successful compromise. Technical telemetry confirms the domain resolves to IP 34.144.206.118, which hosts a minimal HTML interface with embedded JavaScript designed to capture keystrokes and exfiltrate wallet recovery phrases or private keys to attacker-controlled servers. This domain was flagged by PhishDestroy on seed 305406 and remains under active investigation. VirusTotal currently reports 0 detections out of 95 scanning engines, indicating the infrastructure is not yet widely recognized by automated defense systems. The domain operates under a Let’s Encrypt SSL certificate, further enhancing its credibility. The infrastructure is hosted on Google Cloud (IP 34.144.206.118), a common choice for short-lived phishing campaigns due to its reliability and anonymity. The domain was registered through Wix.com’s Wixstudio platform, which allows rapid deployment of subdomains—ideal for threat actors seeking to create believable decoy portals within hours. If you visited logon-smart.wixstudio.com or entered any credentials or wallet information, immediately disconnect from the internet, revoke any session tokens or API keys exposed, and transfer remaining assets to a clean wallet using a hardware device or newly installed software wallet with a restored seed phrase from a trusted source. Do not reuse passwords or recovery phrases across services. Report the incident to PhishDestroy for takedown support and scan your device with updated antivirus software. Avoid interacting with this domain further and warn others who may have received similar links. Always verify URLs through PhishDestroy before entering sensitive information.