trust[.]ethdata[.]vip

trust.ethdata.vip was registered on 11 July 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 154.23.175.169, which is announced by AS8796 FASTNET DATA INC in the United States. The domain is configured with the authoritative name servers a7.share-dns.com and b7.share-dns.net and does not present an SSL/TLS certificate. An HTTP request returns a 503 Service Unavailable status, and the only visible page title is “Mining”. Threat intelligence classifies the site as a wallet/seed phishing operation that impersonates the Binance brand.

VirusTotal records show that two of ninety‑five scanning engines have raised detections for the domain, and the domain appears on a single external blocklist. PhishDestroy has already taken the domain offline and listed it as blocked. Analysis of the available artifacts indicates that the infrastructure is typical of short‑lived phishing infrastructure: a recently created domain, a generic shared‑DNS provider, and a public‑cloud‑grade IP address without TLS protection. The lack of a valid certificate and the 503 response suggest that the hosting service has been taken down or is otherwise unavailable, limiting the ability to confirm the exact page content.

Nonetheless, the combination of brand impersonation, the “Mining” title, and the wallet/seed phishing label provides a clear indicator of intent to harvest cryptocurrency credentials. Defenders should add 154.23.175.169 to network deny lists, block any DNS resolution for trust.ethdata.vip, and monitor for newly registered domains that use the same registrar or name‑server pattern. Continuous observation of VirusTotal and other multi‑engine scanners for re‑appearances is advised, as well as sharing the indicator set with downstream security platforms. The domain’s current offline status does not eliminate the risk of re‑use, and the observed characteristics should be incorporated into broader brand‑impersonation detection rules.