extracredit[.]io

This domain, extracredit.io, is identified as a credential theft operation targeting users of cryptocurrency education platforms. Analysis indicates the site masquerades as a legitimate educational resource, likely harvesting login credentials, personal information, or financial details under the guise of offering cryptocurrency-related courses or rewards. The threat specifically exploits users seeking crypto education, leveraging social engineering tactics to trick victims into disclosing sensitive data. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 104.21.29.129. It is flagged by 2 out of 95 security vendors on VirusTotal and appears on one security blocklist. The domain employs technologies such as Cloudflare, jQuery, and Bootstrap, which are commonly used to enhance functionality but can also obscure malicious activity. The SSL certificate is issued by Google Trust Services, adding a veneer of legitimacy while the site remains offline. Users who visited extracredit.io should immediately revoke any credentials entered on the site and monitor associated accounts for unauthorized activity. If financial information was provided, affected parties should contact their financial institution to secure accounts and review transaction histories. Additionally, scanning the device used to access the domain for malware or unauthorized software is recommended, as credential theft sites may deploy secondary payloads. Organizations should update blocklists to include this domain and its resolving IP to prevent future access attempts.