etsy[.]kleinan[.]online

Analysis of etsy.kleinan.online indicates that the domain was registered on March 22 2026 through Global Domain Group LLC and is hosted behind Cloudflare, as evidenced by the nameservers kellen.ns.cloudflare.com and magdalena.ns.cloudflare.com and the IP address 188.114.97.3, which resolves to a Cloudflare location in Canada. The site presented the page title “etsy.kleinan.online” and lacked an SSL certificate, meaning connections would have been unencrypted. Technical fingerprints show the use of Cloudflare’s HTTP/3 protocol. The domain is classified as an e‑commerce phishing operation, targeting users of the legitimate Etsy marketplace.

VirusTotal recorded a single positive detection out of ninety‑four scanners, and the domain appears on one public blocklist, specifically PhishDestroy, which has already taken the site offline. Independent reputation services assign a Gridinsoft trust score of 0 out of 100, reflecting extreme malicious confidence. No additional intelligence such as Safe Browsing entries, OTX tags, or further vendor detections are available, leaving the full scope of the phishing campaign uncertain.

Defenders should continue to block the IP address 188.114.97.3 at network perimeter devices, add the domain to internal URL filtering lists, and monitor for any future re‑registration attempts or similar sub‑domains that mimic the Etsy brand. Because the site is currently offline, immediate threat mitigation focuses on preventing re‑use of the same infrastructure. Ongoing collection of passive DNS and certificate transparency logs is advised to detect any resurrection of the domain or related infrastructure.