easybit[.]live

The domain easybit.live was observed as part of a brand‑impersonation campaign targeting Ethereum. Registration records show the domain was created on 8 December 2025 through NameCheap, Inc., and it uses the registrar‑provided nameservers dns1.registrar‑servers.com and dns2.registrar‑servers.com. DNS resolution points to the IPv4 address 146.70.118.226, which is announced by AS9009 (M247 Europe SRL) and geolocated to Germany. No TLS certificate was presented when the host was queried, indicating the site operated without HTTPS. VirusTotal scans returned a detection ratio of 2 out of 95 security vendors, confirming that at least two independent scanners flagged the domain as malicious.

The page title returned by HTTP GET was “easybit - Home”, which does not directly reference the targeted brand but aligns with the supplied scam type of brand impersonation. The infrastructure has been listed on a single public security blocklist and was actively blocked by the PhishDestroy filtering service. Reputation services assign very low confidence scores: Gridinsoft rates the domain 0 / 100 and Scamadviser rates it 21 / 100, both indicating a high likelihood of fraudulent use. The site was reported as taken offline at the time of analysis, and no SSL certificate was observed, which may have contributed to the takedown. Uncertainties remain regarding the exact payload or credential‑collection mechanisms, as the page content has not been captured.

Analysts cannot confirm whether a phishing form, malware downloader, or redirect was employed because the HTTP response body was not archived. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any re‑use, and add the AS to watchlists for related activity. Incident response teams encountering references to easybit.live should treat any associated communications as malicious and advise users to avoid interacting with the site.