eggs-finance[.]com

Analysis of eggs-finance.com indicates a generic phishing domain targeting cryptocurrency users, currently offline as of July 25, 2026. The domain was registered on August 27, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 188.114.97.3, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by WE1, a common provider for low-trust domains. The page title 'Nur einen Moment…' suggests a temporary hold or redirect page, often used in phishing campaigns to evade immediate detection or to filter automated scans.

Security vendors have flagged this domain on multiple blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, with a total of four security blocklists listing it as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk infrastructure. While only 3 of 93 security vendors on VirusTotal flagged the domain, this detection rate is consistent with early-stage phishing campaigns that have not yet been widely analyzed. Infrastructure analysis reveals the domain was taken offline, likely due to enforcement actions or abandonment by the threat actor.

However, the use of Cloudflare hosting and a recently registered domain aligns with common phishing tactics to obscure origin and reduce traceability. Defenders should treat this domain as part of a broader phishing operation targeting cryptocurrency wallet credentials or related financial data. Network-level blocking is recommended for organizations handling crypto assets, and security teams should monitor for related domains registered through the same registrar or hosted on identical infrastructure. The exact content of the phishing page remains unanalyzed, but the combination of blocklist presence, trust score, and hosting patterns supports its classification as malicious.