ee[.]vip

This investigation focuses on the domain ee.vip, observed as active on 24 July 2026. The site resolves to the IPv4 address 43.169.27.7, which is announced by AS139341 (ACE) and geolocated to Singapore. The TLS certificate presented is issued by TrustAsia Technologies, Inc. under the TrustAsia DV TLS RSA CA 2025, indicating a valid‑date certificate but offering no mitigation against abuse. VirusTotal reports that one of ninety‑three scanning engines flagged the domain, confirming at least one detection among many scanners. The domain appears on a single security blocklist and is currently listed by PhishDestroy as blocked, reinforcing its malicious reputation. The registrar listed is Go Montenegro Domains, LLC, and the domain was registered on 21 February 2026.

Technical fingerprints show the site is hosted on Amazon Web Services, utilizes Amazon S3 storage, and enforces HTTP Strict Transport Security. Nameserver delegation points to ns1.teodns.com and ns2.teodns.com. An HTTP GET returns status code 200, and the page title captured reads “USDT ZONE | uz.com | Anonymous | Auto Payout | Decentralized cryptocurrency Casi”, which aligns with the reported scam type of crypto gambling. Gridinsoft assigns a trust score of 0 out of 100, indicating the lowest confidence in legitimacy. The phishing kit identified is the “Gambler Scam” kit, which is commonly employed to lure victims into fraudulent cryptocurrency gambling operations. The overall risk rating is high, and the domain remains active.

Defenders should block outbound connections to 43.169.27.7 and add ee.vip to URL filtering and DNS sinkhole lists. Monitoring of TLS certificate changes and the associated AWS resources may provide early indicators of re‑deployment. Because the page title references USDT and auto‑payout mechanisms, threat‑hunters should correlate any observed traffic to known USDT‑related abuse patterns.