easycrypto-au[.]netlify[.]app

This domain, easycrypto-au.netlify.app, is identified as an active crypto wallet phishing site targeting users of cryptocurrency platforms. Analysis indicates the domain impersonates legitimate crypto services, likely deploying a credential-harvesting or wallet-draining kit to steal private keys, seed phrases, or login credentials. The page title, 'easy-crypto,' aligns with common branding used in crypto-related phishing campaigns, suggesting an intent to deceive users into disclosing sensitive financial information.

Technical indicators confirm the domain's malicious nature. The domain is flagged by 3 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. It is registered through Netlify and resolves to the IP address 35.157.26.135, hosted on AWS EC2 in the eu-central-1 region (Germany). The domain was created on April 18, 2026, and is currently listed on three security blocklists, including PhishDestroy and MetaMask. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the threat, as phishing sites frequently use valid certificates to appear legitimate.

As of the latest assessment, the domain remains active and poses a high risk to users. Immediate response actions include blocking the domain at the network level, alerting affected user bases, and monitoring for related infrastructure. Despite its presence on multiple blocklists, the domain continues to operate, indicating persistent threat actor activity. Users are advised to avoid interacting with the site, verify URLs through official channels, and enable multi-factor authentication on crypto wallets to mitigate credential theft risks.