eth700-event[.]com

Analysis indicates that the domain eth700-event.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The site resolves to the Cloudflare address 172.67.155.61, located in the United States and belonging to ASN 13335. The authoritative nameservers leonidas.ns.cloudflare.com and nora.ns.cloudflare.com confirm that the domain is fully proxied behind Cloudflare’s network, which also supplies the presented TLS certificate issued by Google Trust Services under the WE1 root. The server returns HTTP 200 and advertises HSTS, HTTP/3, and a Node.js/Express stack, suggesting a modern web application framework. The page title observed is “Redistribution Event”, and the listed scam type is wallet/seed phishing that impersonates the MetaMask brand.

The domain has been added to four public blocklists and is actively flagged by the anti‑phishing services PhishDestroy, MetaMask, ScamSniffer, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reflecting extreme suspicion. VirusTotal scans show two of ninety‑five security vendors flagging the domain, reinforcing the malicious classification. Evidence confirms that the infrastructure is deliberately hidden behind Cloudflare to obscure origin, while the valid SSL certificate provides a veneer of legitimacy. The combination of a brand‑specific impersonation claim, the “Redistribution Event” title, and the wallet‑seed phishing categorisation points to an attempt to lure MetaMask users into surrendering private keys or recovery phrases.

At present, the site’s internal content has not been publicly dissected, leaving the exact phishing flow unknown. Defenders should immediately block the domain at network borders, update URL filtering policies, and add the IP address 172.67.155.61 to deny‑lists where appropriate. Monitoring for DNS queries to eth700-event.com and for traffic to the associated Cloudflare edge nodes can help detect attempted connections.