win-box[.]netlify[.]app

The domain win-box.netlify.app was a brand impersonation phishing site targeting Ethereum users. It posed as a legitimate Ethereum-related platform under the page title 'Ethereum Events' but was designed to deceive victims into disclosing cryptocurrency-related credentials or transferring funds to attacker-controlled wallets. No drainer kit was identified, and the site is currently taken offline, though it previously operated as a cryptocurrency scam.

Technical analysis of win-box.netlify.app revealed 0 of 95 VirusTotal vendors flagged the domain as malicious, and Google Safe Browsing did not list it as unsafe. The domain appeared on 1 security blocklist, specifically PhishDestroy. It was registered through Netlify and resolved to the IPv6 address 2a05:d014:58f:6200::258, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. The SSL certificate was issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' chain. Technologies detected included Netlify and HSTS, while the HTTP status returned a 404 error at the time of assessment.

Victims who interacted with win-box.netlify.app should immediately revoke any token approvals granted to unknown contracts using tools like Etherscan's token approval checker or Revoke.cash. Funds should be transferred to a new, secure wallet to prevent unauthorized access. Enable two-factor authentication (2FA) on all cryptocurrency exchange and wallet accounts, and monitor for unauthorized transactions. Report the phishing domain to Netlify's abuse team, the impersonated brand (Ethereum), and platforms like PhishTank or Google Safe Browsing to aid in takedown efforts.