30eth[.]eu

30eth.eu is currently active and has been classified as a high‑risk generic phishing site delivering a crypto‑scam payload. The domain resolves to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States) and is served through Cloudflare’s DNS infrastructure using the authoritative name servers toby.ns.cloudflare.com and veronica.ns.cloudflare.com. An HTTP request returns a 403 status code and the page title displayed is “Nur einen Moment…”. The TLS certificate is issued by Google Trust Services under the WE1 entity, indicating a valid HTTPS endpoint. Reputation services show a Gridinsoft trust score of 0/100 and six of ninety‑five VirusTotal scanners have raised detections, while the domain appears on one public blocklist and is already listed by PhishDestroy. The site was registered via Dynadot LLC and employs Cloudflare and HTTP/3 as its visible technologies. Because the content has not been fully inspected, the precise phishing lures and victim‑targeting mechanisms remain unknown. Defenders should immediately block both the domain and its resolved IP at perimeter and DNS layers, monitor for any outbound connections to the address, and consider feeding the indicator into threat‑intel platforms for broader correlation. Ongoing observation is advised to detect any changes in response codes or content that could indicate a shift in the campaign’s tactics.