nothing[.]ceo

nothing.ceo is currently offline but its infrastructure shows typical characteristics of a brand‑impersonation campaign targeting the “base” brand with a wallet/seed phishing objective. The domain was registered on 20 October 2024 through Dynadot LLC and resolves to 188.114.96.3, an address owned by Cloudflare (AS13335) located in the United States. Nameserver delegation to christian.ns.cloudflare.com and savanna.ns.cloudflare.com further confirms the use of Cloudflare’s DNS service, a common choice for fast‑changing malicious sites. No TLS certificate is presented, indicating the site either never served HTTPS or was taken down before a certificate could be provisioned. The HTTP response is marked as “taken offline”, and the page title returned is the literal string “NOTHING”, offering no additional context.

Reputation signals are strongly negative. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that two of ninety‑five scanning engines have flagged the domain, reinforcing the suspicion of malicious activity. The classification as a “Wallet/Seed Phishing” scam aligns with the impersonation of the “base” brand, suggesting that any page that once existed likely attempted to harvest cryptocurrency seed phrases or private keys. Because the site is offline, real‑time content analysis is not possible, and the exact phishing landing page cannot be verified.

However, the combination of recent registration, Cloudflare hosting, lack of TLS, negative reputation scores, and explicit blocklist entries provides sufficient evidence for security teams to treat the domain as hostile. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address, and add the domain to internal blacklists.