klelnanzeigen-deutch[.]find237[.]icu

On 23 July 2026 the domain klelnanzeigen-deutch.find237.icu was observed as part of a brand‑impersonation campaign targeting Eigenlayer. The domain was registered on 2 November 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and delegated to the Cloudflare nameservers laylah.ns.cloudflare.com and yew.ns.cloudflare.com. DNS resolution points to IP address 216.58.206.36, which belongs to AS15169 operated by Google LLC and is geolocated in Germany. No TLS certificate was presented, indicating that the site was served over plain HTTP.

The HTTP response returned the page title “Google”, which does not correspond to the advertised Eigenlayer brand and suggests a generic landing page rather than a forged login portal. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal scans recorded 12 positive detections out of 95 antivirus and URL‑reputation engines, reinforcing the malicious classification. The current status is listed as offline, implying that the site is no longer reachable, but the infrastructure artifacts remain useful for attribution and future mitigation.

Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor for any re‑use of the same registrar, nameserver pair, or hosting IP. Additional investigation is warranted to determine whether the IP address is being abused by other malicious domains, given its association with a large cloud provider. Until the domain is definitively taken down, it should be treated as a high‑confidence phishing indicator.