ens0[.]xyz

The domain ens0.xyz has been confirmed as a cryptocurrency credential harvesting phishing site targeting users of digital wallet platforms. Analysis indicates the site is currently offline, though prior activity involved presenting a fraudulent interface labeled 'Crypto Tools' to deceive victims into disclosing private keys or login credentials. No legitimate brand impersonation was observed, but the generic cryptocurrency-themed deception aligns with common phishing tactics in the blockchain ecosystem. Infrastructure analysis reveals the domain was registered on March 6, 2026, through Sav.com, LLC, and resolved to the IP address 172.67.163.180, a Cloudflare-associated endpoint. Security vendor detections on VirusTotal reached 6 of 95, while the domain appears on four distinct security blocklists. The SSL certificate was issued by Google Trust Services, providing a false sense of legitimacy. Additional technical indicators include the use of Cloudflare and HTTP/3, which are frequently leveraged to obscure malicious infrastructure. Gridinsoft assigned a trust score of 0 out of 100, further corroborating the malicious classification. Current status indicates the domain has been taken offline, though residual risk remains due to potential reemergence under alternate infrastructure. Organizations and individuals are advised to block the domain and associated IP at the network level, update endpoint protection signatures, and monitor for similar cryptocurrency-themed phishing domains registered through the same registrar. Users who may have interacted with this domain should immediately revoke any exposed credentials and transfer assets to new, secure wallets. Proactive threat hunting for related indicators of compromise is recommended to mitigate potential follow-on attacks.