eth-vip6[.]biz

Eth-vip6.biz was registered on December 3, 2025 through GoDaddy.com, LLC and is hosted on Cloudflare's network (AS13335) with the IP address 188.114.96.3 located in the United States. The domain resolves to two Cloudflare nameservers, anita.ns.cloudflare.com and jeremy.ns.cloudflare.com, and presents a Go Daddy Secure Certificate Authority - G2 certificate issued by GoDaddy.com, Inc., indicating a valid TLS handshake at the time of observation. HTTP analysis shows the site served a page titled "Emerging Markets: Where to Invest in 2025 | SearchHounds" while the underlying stack reports Nginx and OpenResty, a configuration often leveraged by malicious actors to host phishing pages.

Security reputation is extremely poor: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has actively blocked it. VirusTotal scans flagged the domain in 15 of 95 antivirus and URL-reputation engines, and the overall classification is a crypto-related scam, consistent with the "Crypto Scam" label in the intelligence feed. The site is currently offline, but the combination of a fresh registration, low-cost SSL, Cloudflare front-end, and multiple vendor detections indicates an intentional, short-lived phishing campaign targeting investors or cryptocurrency users.

Defenders should immediately block both the domain and its underlying IP address, add the domain to URL filtering policies, and continue to monitor the associated Cloudflare nameservers for re-use. Because the hosting infrastructure is shared, additional malicious sites may appear on the same IP range; therefore, network-wide threat-intel feeds should be consulted to detect any resurgence. At present, no further technical artefacts such as malicious payloads or command-and-control endpoints have been observed, leaving the exact campaign scope uncertain.