246[.]uc4wwk4cow48gok0s4ks0cww[.]65[.]109[.]18[.]60[.]sslip[.]io

This domain, 246.uc4wwk4cow48gok0s4ks0cww.65.109.18.60.sslip.io, is actively flagged as a high-risk crypto scam targeting Ethereum users. Analysis indicates the site resolves to IP 65.109.18.60 (AS24940, Hetzner Online GmbH, Finland) and presents a page titled 'Bridge BTC to Ethereum, Arbitrum, Base, Hyperliquid | Garden,' suggesting an attempt to impersonate a cryptocurrency bridging service. The domain was registered on February 21, 2026, through NameCheap, Inc., and uses nameservers associated with sslip.io (ns-ovh.sslip.io, ns-hetzner.sslip.io, ns-do-sg.sslip.io), a dynamic DNS provider often exploited for malicious infrastructure. Infrastructure review reveals the domain is currently active, returning an HTTP 200 status, and appears on at least one security blocklist. Three of 93 security vendors on VirusTotal have flagged the domain, though the specific detection context remains unverified. The SSL certificate is issued by Let's Encrypt (serial E7), a common choice for both legitimate and malicious sites. No evidence of a known phishing kit or additional brand impersonation beyond Ethereum is present in the available data. Defenders should treat this domain as confirmed malicious infrastructure. The use of a dynamic DNS provider, hosting on a bulletproof ASN, and the absence of legitimate branding indicators align with patterns observed in crypto-related scams. Blocking the domain and its resolving IP (65.109.18.60) at the network level is recommended. Further investigation into associated wallet addresses or transaction patterns may be warranted if user interaction data becomes available. The site's content has not been fully analyzed, so additional impersonation targets or malicious functionality cannot be ruled out.