ethyk[.]vip

The domain ethyk.vip has been identified as a brand impersonation phishing threat, specifically targeting Discord users. As of the latest investigation, this domain is currently offline, which indicates that hosting providers or authorities have taken action to disable it. The domain was created on April 16, 2025, and registered through Dynadot LLC, a known registrar often used for malicious domains.

Technical analysis reveals that ethyk.vip resolves to the IP address 3.33.186.135, which is associated with content delivery networks and may be used to host phishing pages. The page title was observed as "Ethereum.org: O guia completo sobre o Ethereum," which is a deceptive tactic to appear as an Ethereum-related site while impersonating Discord. The domain appears on 2 security blocklists and was flagged by 3 out of 95 security vendors on VirusTotal, indicating moderate but not universal detection. The SSL certificate was issued by Google Trust Services, providing a false sense of security to visitors.

Despite being offline, the domain poses a significant risk due to its brand impersonation of Discord, a platform with millions of users. Users who may have encountered this domain before it was taken down could have been exposed to credential theft or malware. It is recommended that users avoid any interactions with ethyk.vip, monitor their Discord accounts for unauthorized access, and enable two-factor authentication. Organizations should block this domain and its associated IP address to prevent future threats.