ad-eth-vip10[.]top

The domain ad-eth-vip10.top was registered on November 20, 2025 through NameSilo, LLC and is currently listed as offline. DNS resolution is handled by Cloudflare nameservers (adam.ns.cloudflare.com and chan.ns.cloudflare.com), pointing to IP address 104.21.2.156, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The site presented a page title of "登录 - DeFi", indicating a Chinese‑language login interface aimed at decentralized finance services. The SSL certificate is issued by Google Trust Services / WE1, confirming the use of a valid HTTPS certificate. Infrastructure analysis reveals the use of Vue.js, Cloudflare’s edge network, and HTTP/3, consistent with modern web‑application stacks.

Detection metrics show that the domain appears on one security blocklist and has been flagged by PhishDestroy. On VirusTotal, 10 of 95 security vendors reported the domain as malicious, reinforcing the suspicion of a phishing or crypto‑related scam. The Gridinsoft trust score is 0 out of 100, indicating a lack of trustworthiness. No further behavioral data, such as payload samples or observed credential harvesting, is available beyond the page title and the listed technical attributes.

Given the combination of a recent registration date, use of reputable CDN services to obscure origin, a low trust score, multiple vendor detections, and the DeFi‑focused page title, analysts conclude that ad-eth-vip10.top was employed in a crypto phishing campaign. Uncertainties remain regarding the exact content delivered to victims and whether any exfiltration of credentials occurred. Defenders should add the domain to local blocklists, enforce DNS sink‑holing for the associated IP range, monitor Cloudflare‑hosted subdomains for re‑use, and inform end users about unsolicited DeFi login requests. Sharing the observed indicators of compromise with broader threat‑intel communities will aid in early detection of similar campaigns.