https://compilyn.net/
104.21.12.197 · Cloudflare, Inc.
Toronto, Canada
46 days
200 · 18.7s
Valid· E8, Let's Encrypt, US
COMPLETED
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
compilyn.net
Vendors
23/30
Status
partial
remix.live-clone-kit
remix-live-clone-kit
Directives: skipAi, skipUnblocker, skipMobileVariant
Cryptocurrency · 6/3/2026
The page presents a CODE COMPILER title on compilyn.net with SPA-like behavior inferred from many JS assets and API endpoints. The page appears to be a code editor environment rather than a classic credential phishing form, and there is no explicit impersonation of a well-known brand in the visible UI. However, several tracking endpoints and wallet-related scripts are loaded, indicating analytics and potential blockchain wallet interactions. The evidence does not conclusively show credential harvesting or impersonation of a third-party brand, but the presence of tracking/config endpoints and wallet integration warrants cautious monitoring for abuse potential. Analyst context noted: This is a fake Remix/Solidity IDE phishing kit. The page imitates a browser-based smart contract compiler and deploy tool, likely targeting Web3 users by encouraging wallet interaction or malicious contract deployment r...
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: Yes
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 54
Hosts: 7
Domains: 7
Suspicious Endpoints
hxxps://compilyn[.]net/api/tracking-config
hxxps://compilyn[.]net/api/trackWallets
hxxps://compilyn[.]net/api/markHuman
The domain compilyn.net is newly registered and resolves behind Cloudflare. The page loads numerous third-party scripts (Google Analytics/Ads, Cloudflare beacon, CodeMirror, Web3, WalletConnect) and exposes endpoints for tracking and wallet-related actions. There is no static login form observed in the HTML, but the SPA architecture means credential capture could occur via dynamically injected forms. While there is no definitive impersonation of a well-known brand, the combination of wallet integration and tracking suggests potential data exposure risks if misused. Recommend monitoring and further analysis of network requests and data handling in the SPA to rule out credential or sensitive data capture. Analyst context was provided and corroborated during this assessment (This is a fake Remix/Solidity IDE phishing kit. The page imitates a browser-based smart contract compiler and deploy tool, likely targeting Web3 users by encouraging wallet interaction or malicious contract deployment r...). Because analyst context identifies an active phishing or fraud kit, domain suspension is recommended rather than passive monitoring.
Suspend Domain