eth-tumbler[.]to

PhishDestroy has identified eth-tumbler.to as a brand impersonation threat with an elevated risk level. This domain poses as the Ethereum brand, specifically luring users with a page titled 'ETH Tumbler - Ethereum Tumbler' to deceive them into connecting their wallets. The site is currently offline, but the risk remains elevated due to its malicious intent and registration details.

The domain was created on May 24, 2024, and registered through the Government of Kingdom of Tonga, a jurisdiction often associated with low scrutiny. It resolves to IP address 45.12.2.86, and its SSL certificate was issued by Let's Encrypt / R13, a free certificate authority commonly abused by threat actors. VirusTotal analysis shows only 1 out of 95 security vendors flagged this domain, indicating low detection coverage. However, it appears on 4 security blocklists, providing some defensive signal. The domain's trust score is minimal, reinforcing the impersonation risk.

To mitigate the threat from eth-tumbler.to, users should block the domain and IP at network perimeters, and avoid any interaction with the site even if it reappears. Organizations should educate users about brand impersonation tactics, particularly those targeting cryptocurrency brands like Ethereum. Email filters and web proxies should be updated to include this indicator, and monitoring for any new domains with similar naming patterns is advised. Reporting the domain to additional security vendors can help increase detection coverage.