auth[.]ethereum[.]vc

This domain, auth.ethereum.vc, is actively impersonating Ethereum as part of a cryptocurrency phishing campaign. Registered on February 21, 2026, through Name.com, Inc., the domain resolves to an IP address (129.213.114.242) hosted on Oracle Corporation's infrastructure (AS31898) in the United States. The site returns an HTTP 200 status and presents a login page titled 'Anmelden - Authelia,' which is inconsistent with Ethereum's official authentication interfaces. The use of Authelia, an open-source authentication portal, suggests an attempt to mimic a legitimate login flow while harvesting credentials. Analysis indicates the domain is flagged by multiple security mechanisms, including Google Safe Browsing for social engineering and three security blocklists. Fourteen out of ninety-five security vendors on VirusTotal detect the domain as malicious, reinforcing its classification as a high-risk threat. The SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. Cloudflare nameservers (quincy.ns.cloudflare.com and aurora.ns.cloudflare.com) are configured, which may obscure additional infrastructure details or provide resilience against takedowns. Defenders should prioritize blocking this domain at the network and endpoint levels, particularly in environments where cryptocurrency transactions or Ethereum-related activities occur. The domain's registration age (under five months) and active status suggest it may remain in use for ongoing campaigns. Monitoring for similar patterns, such as subdomains mimicking Ethereum or other cryptocurrency brands, is recommended. While the exact phishing kit or backend infrastructure remains unconfirmed, the combination of brand impersonation, social engineering flags, and blocklist presence justifies immediate mitigation actions. No legitimate Ethereum services are associated with this domain.