easybank-sand[.]vercel[.]app

This domain, easybank-sand.vercel.app, is flagged as an active credential theft operation targeting EasyBank customers. Analysis indicates the site mimics legitimate EasyBank landing pages, likely harvesting login credentials and personal banking details through deceptive input forms. No direct evidence of a crypto drainer kit was observed, but the presence of banking-themed phishing elements suggests financial credential exfiltration as the primary objective. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 21/95 security vendors, registration through Vercel Inc., resolution to IP 216.198.79.131 (US, AS16509 Amazon.com, Inc.), and domain creation on March 06, 2026. The SSL certificate is issued by Google Trust Services (WR1), and the domain appears on one security blocklist (PhishDestroy). Google Safe Browsing status was not explicitly provided but is likely flagged given the detection rate. The domain remains active as of the latest verification, despite its presence on blocklists. Response actions should include immediate blacklisting in enterprise security gateways, DNS sinkholing, and alerting affected financial institutions. Remaining risk is high due to the domain's operational status and low blocklist adoption. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication for all banking portals to mitigate potential account takeovers.