easybank-figma[.]vercel[.]app

The domain easybank-figma.vercel.app poses a serious threat as a banking phishing site. It is actively flagged by 17 out of 93 vendors on VirusTotal, indicating a significant level of detection among security vendors. The domain is hosted in the United States under Amazon's infrastructure, specifically with the IP address 216.198.79.195. Its SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy to unsuspecting users.

This domain attempts to mimic legitimate banking services, likely targeting users of Easybank. The use of 'figma' in the subdomain might be an attempt to confuse users into thinking it is related to a design tool, thereby lowering their guard. The site is currently active and has been added to at least one public blocklist, specifically PhishDestroy's, highlighting its ongoing threat to users.

Despite being created in early 2020, this domain was first detected by PhishDestroy in January 2026, suggesting it may have been dormant or inactive for a period before being utilized for phishing attacks. The relatively high number of VirusTotal detections suggests that the domain is part of a broader phishing campaign, potentially targeting multiple users or organizations. Its use of a reputable hosting service and SSL issuer indicates a sophisticated approach to phishing, aiming to bypass basic security checks and deceive users into divulging sensitive banking information.