enssdomains[.]xyz

This domain is flagged as an Ethereum Name Service (ENS) credential phishing site, targeting users of decentralized naming systems with fraudulent login interfaces. The threat is classified as elevated due to its specific focus on cryptocurrency-related credentials, which carry higher financial risk than generic credential harvesting. Analysis indicates the domain was designed to mimic legitimate ENS platforms, potentially tricking users into disclosing wallet credentials or private keys. Infrastructure analysis reveals the domain was registered on May 31, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with malicious domains. It resolves to IP address 188.114.96.3 and employs Cloudflare services, including HSTS and HTTP/3 protocols, likely to obfuscate hosting origins and evade detection. Security vendor detections include 4/95 flags on VirusTotal, with listings on two security blocklists. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The page title 'ENS' suggests an attempt to impersonate the legitimate Ethereum Name Service, a common tactic in cryptocurrency phishing schemes. Mitigation for this threat type requires multi-layered defenses. Network-level protections should include blocking the domain and its resolving IP (188.114.96.3) at firewalls and DNS resolvers. Endpoint security measures must prioritize detection of ENS-themed phishing pages, particularly those hosted behind Cloudflare, which may bypass traditional URL filtering. User awareness training should emphasize verification of domain authenticity before entering wallet credentials, including checking for SSL certificate transparency logs and cross-referencing with official ENS documentation. Organizations handling cryptocurrency transactions should implement strict allowlisting of known ENS domains and monitor for unauthorized access attempts from untrusted sources.