evobyt[.]ro

PhishDestroy identifies **evobyt.ro** as an active cryptocurrency wallet phishing domain designed to deceive users into revealing sensitive wallet credentials or private keys. The threat actor behind this domain has registered it specifically to mimic legitimate wallet interfaces, likely targeting customers of popular cryptocurrency platforms such as MetaMask. Upon visiting, users are prompted to enter their seed phrases, recovery keys, or login credentials into fraudulent forms that harvest this data for unauthorized access to victim wallets. This domain abuses legitimate hosting infrastructure (IP 193.33.24.68) to appear credible and hosts cloned login pages that closely replicate authentic wallet interfaces. This domain was flagged by security blocklists and blocked by MetaMask, indicating confirmed malicious intent. The domain evobyt.ro was registered through ICI Registrar on November 28, 2017, and currently appears on one known security blocklist. As of this report, VirusTotal scans using 95 antivirus engines returned zero detections, suggesting it remains undetected by many security solutions despite its malicious activity. If you have visited evobyt.ro or entered any credentials or wallet-related information, immediately revoke access from your wallet, transfer assets to a new wallet, and scan your device for malware using a trusted antivirus tool. Never reuse passwords or seed phrases across platforms. Report any suspicious activity to your wallet provider and consider enabling multi-factor authentication on all cryptocurrency accounts. Stay vigilant and verify URLs through official sources before entering sensitive information.