ecoseed[.]id

PhishDestroy identifies EcoSeed.id as an active generic phishing domain operating as a crypto drainer designed to deceive users into transferring cryptocurrency to fraudulent wallets. This domain was flagged on a single security blocklist and has evaded detection by most antivirus engines, with current VirusTotal detections at 0 out of 95 scanners. The domain resolves to IP address 27.126.180.91, was registered through PT Jagat Informasi Solusi (int) on August 23, 2025, and holds a Let's Encrypt SSL certificate — standard infrastructure often abused by threat actors to appear legitimate. Maltrail has already blocked this domain, indicating early-stage malicious activity. Technical analysis reveals this domain employs generic phishing tactics likely targeting crypto investors through social engineering campaigns or impersonation of legitimate cryptocurrency services. The combination of a recently registered domain (August 2025), low detection rate on VirusTotal, and presence on a single blocklist suggests this threat is in the initial deployment phase. The SSL certificate provides a false sense of security, as criminals frequently use free certificates to mimic legitimate websites. Given the absence of detections on major scanning platforms, users should treat this domain with extreme caution regardless of its current lack of flags. Users who have visited EcoSeed.id should immediately check their cryptocurrency wallet applications for unauthorized transactions or connected malicious sites. Disconnect any wallets that may have interacted with this domain, enable transaction alerts if available, and consider transferring remaining funds to a secure wallet. Run a full antivirus scan on devices used to access this domain, clear browser cache and cookies, and avoid entering any credentials or cryptocurrency wallet information on this or related domains. Report the domain to your security team or relevant authorities if you suspect credential exposure.