eth1d[.]ltd

This domain eth1d.ltd is currently offline but was previously observed hosting a Binance‑related wallet‑seed phishing page titled “USDC”. The authoritative name servers listed in DNS are anita.ns.cloudflare.com and jeremy.ns.cloudflare.com, both belonging to Cloudflare, Inc., which also serves as the registrar. DNS resolution points to the IP address 172.67.161.74, an address owned by Cloudflare (AS13335) and geolocated to the United States. No TLS certificate was presented, indicating the site was served over plain HTTP.

Reputation services flag the domain as highly malicious: Google Safe Browsing classifies it as social engineering, Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 12 of 95 scanned security vendors flagged the host. The domain appears on a single external blocklist and has been taken down by the PhishDestroy takedown service. The page title “USDC” suggests the content was intended to lure victims into submitting cryptocurrency wallet seeds, consistent with the reported scam type of wallet/seed phishing. Because the infrastructure relies on Cloudflare’s shared hosting, the underlying IP may be reused by unrelated legitimate sites, limiting the usefulness of IP‑based blocking alone.

Defenders should continue to block the domain name and any subdomains, monitor DNS queries for the listed name servers, and add the IP address to threat‑intel feeds with a high‑severity tag. Since the site is offline, active mitigation focuses on preventing future re‑registration of the same name or similar look‑alike domains, and on educating users about unsolicited requests for Binance wallet credentials, especially those referencing USDC. Ongoing observation of Cloudflare‑hosted assets associated with the same name servers is recommended to detect potential re‑use of the phishing kit.