eth-s[.]space

This domain, eth-s.space, operates as a targeted cryptocurrency phishing platform designed to harvest wallet credentials and private keys through deceptive interfaces mimicking legitimate blockchain services. Analysis indicates the infrastructure specifically targets users of decentralized finance (DeFi) platforms, employing fake wallet connection prompts and token approval requests to facilitate unauthorized asset transfers. The domain's technical implementation includes Web3 integration scripts that intercept and exfiltrate sensitive authentication data, with particular focus on MetaMask and similar browser-based wallet extensions. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered through HOSTINGER operations, UAB on December 31, 2025, demonstrating future-dated creation typical of disposable phishing infrastructure. It resolves to IP address 43.132.149.152 and is currently flagged by 7 of 95 security vendors on VirusTotal, including detection for credential theft and malicious Web3 activity. The domain appears on three independent security blocklists and maintains a Gridinsoft trust score of 0/100, confirming its malicious classification. Additional telemetry shows the domain was proactively blocked by multiple wallet security providers prior to takedown. Users who interacted with eth-s.space should immediately revoke all connected wallet authorizations through their wallet's connected sites interface. Any credentials entered should be considered compromised, necessitating migration to new wallet addresses with fresh seed phrases. All connected decentralized applications should be reviewed for unauthorized transactions, particularly those involving token approvals or contract interactions. System-level scans for browser-based malware are recommended, as phishing sites frequently deploy secondary payloads to maintain persistence. The domain's current offline status does not eliminate risk, as harvested credentials may be exploited through other infrastructure or sold to third-party threat actors.