mycrypto[.]sbs

This domain mycrypto.sbs is flagged as a high-risk phishing threat impersonating the MyCrypto Wallet platform. Registered on May 14, 2026, through HOSTINGER operations, UAB, the domain is currently active and resolving to IP address 147.93.39.249, which is hosted in Brazil on Hostinger infrastructure. The page title is set to MyCrypto Wallet — Sign In, directly mimicking the legitimate MyCrypto login interface to harvest user credentials or private keys. The domain uses SSL certificates issued by Google Trust Services / WR1, giving it a false sense of security to visitors. Infrastructure analysis reveals the domain is configured with nameservers helios.dns-parking.com and aster.dns-parking.com, which are associated with parking services. The domain has been flagged by three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX includes this domain in one threat intelligence pulse, and VirusTotal shows 1 out of 95 security vendors flagging it as malicious. The Gridinsoft trust score is 0 out of 100, indicating strong consensus on its malicious nature. What remains uncertain is the exact method of distribution for this phishing page, such as whether it is being spread via email campaigns, social media, or search engine ads. Additionally, the full scope of data capture mechanisms on the page is not confirmed from current intelligence alone. Defenders should immediately block access to mycrypto.sbs at the network and email gateway levels, and add the domain to blocklists used by their security tools. Users who have interacted with this domain should be warned to change their MyCrypto Wallet credentials and enable two-factor authentication if not already active. Organizations should search internal logs for any connections to 147.93.39.249 or the domain itself, and investigate any credentials entered on this page as potentially compromised. The domain remains active as of July 12, 2026, and continued monitoring is advised.