eth-vip2[.]biz

The domain eth-vip2.biz was identified as a brand impersonation phishing site targeting Binance, a major cryptocurrency exchange. Analysis indicates the site operated as a fraudulent platform designed to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. The page title, "USDC," suggests an attempt to mimic legitimate stablecoin-related services, a common tactic in cryptocurrency-themed phishing campaigns. Infrastructure analysis reveals the domain was registered on December 03, 2025, through GoDaddy.com, LLC, and resolved to the IPv6 address 2606:4700:3030::6815:2b6e, hosted on Cloudflare, Inc. (AS13335) infrastructure in the United States. Security vendors flagged the domain in 13 of 95 VirusTotal scans, and it appeared on at least one security blocklist. The SSL certificate was issued by GoDaddy.com, Inc. via the Go Daddy Secure Certificate Authority - G2, a legitimate but frequently abused certificate authority in phishing operations. The domain was subsequently taken offline following detection and reporting. The risk posed by eth-vip2.biz is assessed as elevated due to its direct targeting of cryptocurrency users, a high-value demographic for threat actors. While the domain is currently offline, similar infrastructure may resurface under different names. Organizations and users are advised to block the domain and its associated IP at the network level, monitor for related indicators of compromise (IOCs), and implement multi-factor authentication (MFA) for cryptocurrency accounts. Security teams should review logs for connections to 2606:4700:3030::6815:2b6e and audit certificate transparency logs for additional domains issued by the same registrar or certificate authority during the same timeframe.