started-lives-eng[.]wixstudio[.]com

Domain started-lives-eng.wixstudio.com is under active investigation as a crypto-draining operation impersonating an unspecified brand via a Wix Studio storefront. The page harvests private wallet keys or seed phrases and immediately sweeps assets to attacker-controlled wallets. PhishDestroy has not yet identified the drainer kit’s distinctive JavaScript, but the low VirusTotal score (0 detections out of 95 engines) and the use of a Let’s Encrypt certificate suggest the actors are rotating infrastructure to evade static detection.

Technical indicators confirm the page resolves to IP 34.144.206.118, operated by Google Cloud (ASN 15169). Creation date for the domain is still under analysis; the Let’s Encrypt certificate was issued within the last 72 hours, indicating a fresh campaign. At the time of writing, Google Safe Browsing (GSB) has not yet blacklisted the URL, and public blocklists (such as PhishTank, OpenPhish, and URLVoid) show zero detections against this exact domain. Network scans reveal only HTTPS on 443/tcp; no other ports expose services, reducing the operational footprint but increasing reliance on browser-based attacks.

The campaign remains active, but containment is partially effective: PhishDestroy’s real-time crawlers flag the page within minutes of discovery, and browser extension blocks are being distributed to users who have opted into experimental heuristics. Remaining risk is MODERATE because the drainer logic has not been fully reverse-engineered, and the domain’s cloud hosting allows rapid IP migration. Users are advised to avoid the page, verify any Wix-hosted crypto site via PhishDestroy’s URL lookup before entering credentials or connecting wallets, and disable browser notifications from suspicious subdomains. Community reports and automated telemetry will continue to refine the detection model until the drainer kit is fully mapped.