eclipsvm[.]xyz

The domain eclipsvm.xyz is currently offline but was previously observed serving a Cloudflare interstitial page titled “Attention Required! | Cloudflare”. Registration data shows the domain was created on July 08, 2025 and is listed with the registrar PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IP address 172.67.161.216, which belongs to AS13335 Cloudflare, Inc., located in the United States.

No TLS certificate was presented for the host, indicating that HTTPS was not configured at the time of capture. Threat intelligence sources have classified the site as a generic phishing operation and have assigned an elevated risk rating. Four of ninety‑five VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy feed.

Although only a single nameserver is listed, the infrastructure is hosted behind Cloudflare’s edge network, which can obscure the true origin of the malicious payload. Defenders should continue to block the IPv4 address 172.67.161.216 and add eclipsvm.xyz to URL filtering policies, especially those protecting email gateways and web proxies. Ongoing monitoring of the domain’s DNS records is recommended in case the site is re‑activated, and any future TLS certificates should be inspected for suspicious issuance patterns. The limited public exposure – a single blocklist entry and modest vendor detections – suggests the campaign may be in an early stage or targeting a narrow audience, but the zero‑trust score and phishing classification warrant immediate inclusion in defensive controls.