easy-banking-rho[.]vercel[.]app

The domain easy-banking-rho.vercel.app is currently identified as a high-risk credential theft threat. This domain is hosting a webpage titled 'Easybank landing page', posing as a legitimate banking service to deceive users into revealing sensitive information. The operation appears aligned with typical banking phishing activities, aimed at harvesting credentials from unwary users. There is no specific indication of a crypto drainer kit being employed in this campaign.

Technical indicators confirm this domain is flagged by 20 out of 95 security vendors on the VirusTotal platform, evidencing significant detection and acknowledgment of its threat potential. The domain, registered through Tucows Domains Inc., was created on February 21, 2026, suggesting it is relatively new yet already active in malicious activities. The domain resolves to the IP address 64.29.17.131, located in the United States under Amazon AS16509. Additionally, the SSL certificate is issued by Google Trust Services / WR1. It appears on two security blocklists: PhishDestroy and PhishingDB.

The current status of the domain is active, presenting a continuing risk of credential theft. Immediate response actions should include blocking the domain through network security appliances and informing users of the ongoing threat. It is also advisable to monitor for any further developments or related domains emerging from the same IP address. Maintaining vigilance against such phishing attempts is critical to protecting sensitive information from being harvested by malicious actors.