layerbrett[.]io

Analysis indicates that layerbrett.io is an active phishing domain targeting cryptocurrency users with a crypto drainer scheme. The domain was registered on February 21, 2026, through CommuniGal Communication Ltd. and currently resolves to IP address 78.159.156.48, hosted on AS25211 in the Netherlands. Infrastructure analysis reveals the use of Nginx as the web server software, with a 302 HTTP redirect status observed during recent scans. The domain's page title, 'LayerBrett | Fast & Rewarding Layer 2 Blockchain,' suggests an attempt to impersonate a legitimate blockchain or cryptocurrency service, though no specific brand impersonation has been confirmed from available data. The domain is flagged by two security blocklists and has been identified as malicious by three of 93 security vendors on VirusTotal. MX records point to park-mx.above.com, and nameservers are ns15.abovedomains.com and ns16.abovedomains.com, a configuration commonly associated with low-reputation or disposable hosting infrastructure. The SSL certificate is issued by Let's Encrypt, which does not inherently indicate legitimacy due to its widespread use across both legitimate and malicious domains. Defenders should treat this domain as high-risk and prioritize blocking it at the network and endpoint levels. Given its classification as a crypto drainer, users should be warned against connecting wallets or entering credentials on this site. Further investigation into associated wallet addresses or transaction patterns linked to this domain is recommended to identify potential victim interactions. The domain remains active as of July 12, 2026, and continued monitoring is advised.