cc77[.]us

This domain, cc77.us, is identified as a credential harvesting phishing site specifically targeting users of decentralized platforms. Analysis indicates the site mimics legitimate Web3 interfaces to trick visitors into submitting sensitive authentication details, including wallet credentials and private keys. The fraudulent infrastructure leverages common web technologies to appear authentic while exfiltrating stolen data to attacker-controlled endpoints. Evidence supporting this assessment includes detection by 5 out of 95 security vendors on VirusTotal, with the domain also appearing on 3 distinct security blocklists. Infrastructure analysis reveals the domain was registered through a major registrar on May 31, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. The site resolves to the IP address 185.181.254.182 and employs WordPress, MySQL, PHP, and other standard web technologies to facilitate its deceptive operations. Users who visited cc77.us should immediately revoke any active sessions, rotate credentials for all associated accounts, and scan their systems for malware. Wallet holders must transfer assets to a new secure wallet and monitor transaction histories for unauthorized activity. Network administrators are advised to block the domain and its resolving IP at the perimeter, while security teams should investigate logs for connections to 185.181.254.182 or related indicators of compromise. The domain is currently offline, but threat actors may re-establish operations under a different infrastructure.