layer2savings[.]jp

Retained for the record. This text repeats stored detection facts and is not presented as authored analysis.

This domain, layer2savings.jp, is flagged as a cryptocurrency wallet phishing site targeting Japanese-speaking users. The page title, "Layer 2 クオンコインツ貯蓄," suggests an attempt to impersonate a Layer 2 cryptocurrency savings or staking service, likely aiming to harvest wallet credentials or private keys. No specific drainer kit or known brand impersonation has been conclusively identified at this stage, though the use of localized language indicates a targeted phishing campaign.

Infrastructure analysis reveals the domain was registered on July 07, 2026, with no prior history or detections. It resolves to the IP address 108.187.37.99 and uses a Let's Encrypt SSL certificate for encryption. VirusTotal reports 0/95 detections, indicating no antivirus engines have flagged the domain as malicious yet. The registrar details remain undisclosed, and no entries exist on Google Safe Browsing or other major blocklists. The absence of prior detections does not preclude malicious intent, particularly given the recent registration date and targeted phishing theme.

As of the latest assessment, the domain remains active and unresolved by security vendors. No takedown requests have been observed, and the site continues to serve content. Users are advised to block the domain and IP address at the network level and monitor for credential theft or unauthorized transactions if exposure has occurred. Further investigation is required to determine the full scope of the campaign, including potential ties to other phishing infrastructure or wallet drainer kits.