whitelist-supra[.]com

PhishDestroy has identified the domain whitelist-supra.com as an active credential theft operation targeting users of the Supra Token platform. This domain is designed to harvest login credentials by impersonating legitimate Supra Token services, a tactic commonly employed to gain unauthorized access to cryptocurrency wallets and sensitive user data. As of the latest analysis, the domain remains operational and continues to pose a significant risk to unsuspecting victims. The domain whitelist-supra.com was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolving to the IP address 188.114.96.3. Security vendors on VirusTotal have flagged this domain as malicious, with 3 out of 95 vendors confirming its involvement in phishing activities. The SSL certificate for this domain is issued by Google Trust Services, specifically under the WE1 intermediate certificate, which may lend an air of legitimacy to the fraudulent site. Despite this, the domain exhibits multiple indicators of compromise, including its recent registration and association with known phishing infrastructure. At present, whitelist-supra.com remains active and continues to threaten users who may be tricked into entering their credentials. Organizations and individuals are strongly advised to block access to this domain at the network level and update endpoint protection solutions to recognize and mitigate this threat. Users should exercise extreme caution when interacting with any communication or website related to Supra Token, verifying URLs through official channels before entering sensitive information. Security teams are encouraged to monitor for any signs of credential theft or unauthorized access linked to this domain and to educate users on recognizing phishing attempts.