ethiz[.]xyz

This domain, ethiz.xyz, is actively flagged as a high-risk crypto scam targeting users through deceptive decentralized finance (DeFi) or token-swapping services. Registered on February 21, 2026, through a registrar based in Japan, the domain remains operational as of July 12, 2026, resolving to IP address 172.67.131.189, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals the use of Cloudflare nameservers, including a verification subdomain (verification-gakbzzzqmt6gkcplw4efpp.ns), which may indicate an attempt to bypass security checks or automate domain validation. The page title 'USwap' suggests a focus on a swap or exchange service, though no specific legitimate brand is confirmed as the target. The domain appears on at least one security blocklist, and four out of 93 security vendors on VirusTotal have flagged it as malicious. The SSL certificate is issued by WE1, a provider commonly used for both legitimate and fraudulent domains, offering no definitive indication of intent. While the HTTP status code 200 confirms the site is accessible, the exact content and functionality remain unanalyzed. Defenders should treat this domain as an active threat, particularly in environments where cryptocurrency transactions or DeFi platforms are utilized. Monitoring for connections to 172.67.131.189 or the domain itself, along with blocking access based on existing blocklist entries, is recommended. Further investigation into associated wallet addresses or transaction patterns may reveal additional indicators of compromise.