eclipse-xyz[.]pages[.]dev

This domain, eclipse-xyz.pages.dev, is actively flagged as a high-risk phishing site targeting cryptocurrency users under the pretext of a 'Mint tETH' operation. Analysis indicates the domain was registered on May 3, 2026, through Cloudflare and remains operational as of July 12, 2026, resolving to IP 188.114.96.3 (Cloudflare infrastructure in Canada). The page title explicitly references 'Mint tETH,' suggesting an attempt to deceive users into interacting with fraudulent token minting or wallet-draining mechanisms, though the exact content and functionality of the site have not been fully analyzed. Infrastructure review shows the domain employs standard Cloudflare protections, including HSTS, HTTP/3, and a Google Trust Services SSL certificate, which may complicate detection or takedown efforts. Technologies detected include SweetAlert2 and jsDelivr, commonly used in phishing kits for dynamic content delivery. The domain appears on two security blocklists (PhishDestroy and ScamSniffer) and is flagged by 2 of 91 vendors on VirusTotal, reinforcing its malicious classification. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency-related activity is common. The use of Cloudflare nameservers (alec.ns.cloudflare.com, alice.ns.cloudflare.com) and a .pages.dev subdomain aligns with patterns observed in ephemeral phishing campaigns. No legitimate association with Ethereum, testnet tokens, or related services has been identified. Given the domain's recent creation and active status, monitoring for related subdomains or newly registered lookalike domains is recommended.