eciipse[.]run

This domain, eciipse.run, is flagged as a brand impersonation threat specializing in crypto airdrop scams. Analysis indicates the site mimics legitimate Eclipse blockchain promotions to deceive users into connecting wallets, likely deploying a crypto drainer script to siphon assets. The page title, 'Eclipse Airdrop,' directly aligns with known fraudulent campaigns targeting cryptocurrency holders seeking token distributions. Infrastructure analysis reveals the domain was registered on July 4, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 172.67.148.122, a Cloudflare proxy endpoint commonly used to obscure hosting origins. Detection metrics show 3 of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was actively blocked by PhishDestroy prior to takedown. No entries were found in Google Safe Browsing at the time of analysis. Current status indicates eciipse.run has been taken offline, though residual risk remains for users who may have interacted with the site before deactivation. The registrar and hosting infrastructure could be repurposed for future campaigns, necessitating continued monitoring. Users are advised to revoke any wallet connections made to the domain and verify transactions for unauthorized transfers. Organizations should update blocklists to include this domain and its associated IP to prevent re-emergence.