eng-trrzor[.]wixstudio[.]com

This domain, eng-trrzor.wixstudio.com, was identified as a malicious phishing site designed to drain cryptocurrency wallets. The site impersonated legitimate wallet services to trick users into entering private keys or seed phrases, which attackers then used to steal funds. Analysis indicates this was a targeted attack against cryptocurrency holders, leveraging social engineering tactics to exploit trust in well-known wallet brands. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on May 02, 2026, an unusually future-dated creation that suggests potential domain spoofing or backdating. It resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and used a Let's Encrypt SSL certificate to appear legitimate. Detection metrics show 15 out of 95 security vendors flagged the domain as malicious, while it appeared on three security blocklists, including PhishDestroy and PhishingArmy. The site employed technologies such as React, Lodash, and Google Cloud CDN, which are common in both legitimate and malicious deployments but do not mitigate its fraudulent intent. Users who visited eng-trrzor.wixstudio.com should assume their wallet credentials were compromised. Immediate actions include disconnecting any linked wallets from decentralized applications, transferring remaining funds to a new wallet with a fresh seed phrase, and monitoring transaction histories for unauthorized activity. If private keys or seed phrases were entered, consider the original wallet permanently compromised. Additionally, scan local devices for malware, as phishing sites may deploy additional payloads. Report the incident to relevant blockchain security teams and consider updating security practices to verify domain authenticity before entering sensitive information.