ebonizz[.]cyou

The domain ebonizz.cyou has been identified as a confirmed crypto drainer phishing endpoint, designed to illicitly extract cryptocurrency wallet credentials from victims. Analysis indicates the domain is currently offline, though prior activity suggests it operated as an active threat vector targeting users through deceptive wallet interaction prompts. No legitimate association with cryptocurrency platforms or services has been established, and the domain exhibits characteristics consistent with malicious infrastructure. Infrastructure analysis reveals the domain was registered on April 4, 2026, through Dynadot LLC, a registrar frequently observed in phishing operations. It resolves to the IP address 37.77.150.150, geolocated in the Russian Federation and associated with LLC Baxet, a hosting provider linked to prior malicious campaigns. The domain lacks an SSL certificate, a common red flag for fraudulent sites. Detection metrics further corroborate its malicious nature: 21 of 95 security vendors on VirusTotal flagged ebonizz.cyou as malicious, and it appears on three distinct security blocklists, including high-confidence threat intelligence feeds. No legitimate content or services were observed during active monitoring. Current status indicates the domain has been taken offline, though the underlying infrastructure remains a potential risk. Organizations and individuals are advised to implement network-level blocking for the IP 37.77.150.150 and monitor for re-registration attempts under similar naming conventions. Users who interacted with the domain should immediately revoke wallet permissions, transfer assets to new wallets, and conduct a thorough security audit of associated devices. Proactive monitoring of registrar activity for newly created domains with analogous patterns is recommended to mitigate future threats from this actor.