d2ea563b[.]website-private-8xc[.]pages[.]dev

This domain, d2ea563b.website-private-8xc.pages.dev, is flagged as a high-risk brand impersonation threat targeting Ethereum users. Analysis indicates the site employs phishing tactics to deceive victims into disclosing wallet credentials or transferring cryptocurrency to attacker-controlled addresses. The page title, "Horizen - Cryptocurrency and Sidechain Platform," is misleading, as the domain impersonates Ethereum infrastructure rather than the Horizen project. No direct evidence of a drainer kit was observed, but the site’s structure aligns with common credential-harvesting phishing frameworks. Infrastructure analysis reveals the domain resolves to IP address 172.66.44.90, hosted on Cloudflare’s network (AS13335). It is registered through Cloudflare, Inc., and its SSL certificate is issued by Google Trust Services (WE1). VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. The domain appears on one security blocklist, and its registration details lack transparency, a common trait in phishing operations. No creation date was provided, but the active status and recent detection suggest recent deployment. The domain remains active as of this report, posing an ongoing risk to Ethereum users. Response actions include blocking the domain at the network level and alerting wallet providers to flag interactions with it. Despite these measures, the risk persists due to the domain’s hosting on a reputable CDN, which may delay takedown efforts. Users are advised to verify domain authenticity before entering credentials and to cross-reference wallet addresses with official Ethereum resources. Monitoring for similar domains using the seed "2a9af1" may aid in identifying related threats.