raysort[.]netlify[.]app

This domain, raysort.netlify.app, operates as an active cryptocurrency phishing infrastructure designed to harvest wallet credentials and private keys from unsuspecting users. Analysis indicates the site mimics legitimate cryptocurrency platforms, employing social engineering tactics to deceive visitors into entering sensitive authentication details. The domain specifically targets users of decentralized finance (DeFi) applications and self-custody wallets, a common vector for financial theft in the cryptocurrency ecosystem. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 11 out of 95 security vendors on VirusTotal, with detection labels including 'phishing' and 'fraudulent site.' It appears on three distinct security blocklists and is actively blocked by multiple cryptocurrency-specific security layers. The domain was registered through Netlify on March 06, 2026, an unusually future-dated creation timestamp that may indicate domain generation algorithm (DGA) abuse or registry manipulation. The site resolves to IP address 63.176.8.218, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany, and presents a 'Site not found' page title, potentially masking its true functionality from automated scanners while remaining operational for targeted victims. Users who have visited raysort.netlify.app or entered credentials on this domain should assume compromise of any sensitive information. Immediate action is required: revoke access to all connected wallet sessions, transfer assets to new secure wallets using fresh seed phrases, and monitor all associated accounts for unauthorized transactions. The domain's SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides no assurance of legitimacy, as phishing sites routinely abuse valid certificates to appear trustworthy. Given the high risk level and active status, organizations should update network security policies to block both the domain and its resolving IP address across all endpoints and perimeter defenses.