b[.]crypto-eth[.]net

Analysis of the domain b.crypto-eth.net indicates it was actively involved in a crypto scam phishing operation as of July 2026. The domain, registered on January 23, 2025, through Gname.com Pte. Ltd., resolved to the IP address 104.21.87.144, hosted on Cloudflare's infrastructure (AS13335) in the United States. The page title 'defi-ETH' suggests the site targeted decentralized finance (DeFi) users, aligning with the reported scam type of crypto fraud. No SSL certificate was detected, increasing the risk of unencrypted data transmission.

The domain appeared on one security blocklist, specifically PhishDestroy, and was flagged by one of 93 security vendors on VirusTotal, though the specific detection context remains unverified. Nameservers anita.ns.cloudflare.com and jeremy.ns.cloudflare.com further link the domain to Cloudflare's network, a common choice for both legitimate and malicious infrastructure due to its privacy and resilience features. At the time of reporting, the domain was taken offline, though its prior activity and infrastructure warrant continued monitoring. Defenders should treat this domain as part of a broader crypto phishing campaign, particularly targeting users of DeFi platforms.

The lack of SSL encryption and reliance on Cloudflare hosting are consistent with low-effort phishing setups designed for short-term exploitation. Given the domain's age and registration details, it may reappear under similar naming conventions or infrastructure. Network-level blocks on the resolved IP (104.21.87.144) and monitoring for related domains registered via Gname.com Pte. Ltd. are recommended mitigations. The exact content or functionality of the phishing page remains unanalyzed, but the 'defi-ETH' title provides a clear indicator of its likely focus.