easybank-landing-page-alpha-seven[.]vercel[.]app

The domain easybank-landing-page-alpha-seven.vercel.app is actively engaged in credential theft targeting Easybank customers. Analysis confirms the domain is currently operational, designed to harvest login credentials through a fraudulent landing page mimicking the legitimate Easybank interface. The threat type is classified as high-risk due to its direct targeting of financial account access. Infrastructure analysis reveals the domain is registered through Vercel Inc. and resolves to the IP address 216.198.79.131, hosted on Amazon.com, Inc. infrastructure (AS16509). Security vendors have flagged this domain in 19 of 95 VirusTotal scans, indicating broad detection across multiple threat intelligence platforms. The SSL certificate is issued by Google Trust Services (WR1), a common tactic to lend false legitimacy. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious intent. Current status remains active, posing an ongoing risk to unsuspecting users. Immediate mitigation steps include blocking the domain at the network level, updating endpoint protection rules to include the IP address 216.198.79.131, and alerting users to verify URLs before entering credentials. Organizations should monitor for related indicators of compromise, such as unusual login attempts or unauthorized transactions, and consider implementing multi-factor authentication to mitigate credential theft risks.