ecoseed[.]world

Analysis of the domain ecoseed.world indicates it was actively involved in a wallet seed phishing campaign targeting cryptocurrency users. The domain was registered on March 11, 2026, through NameSilo, LLC, a registrar frequently observed in phishing operations. Infrastructure analysis reveals the domain resolved to the IP address 18.245.86.42, hosted on Amazon.com, Inc. (AS16509) infrastructure located in Germany. Nameservers associated with the domain, agustin.ns.cloudflare.com and liberty.ns.cloudflare.com, suggest the use of Cloudflare services, a common tactic to obscure hosting origins and evade detection. The domain's SSL certificate, issued by Amazon (Amazon ECDSA 256 M04), aligns with the hosting provider but provides no inherent trust validation.

At the time of analysis, the domain was flagged by 4 of 94 security vendors on VirusTotal, indicating a moderate level of detection. It also appeared on one security blocklist, specifically PhishDestroy, and was identified in two threat intelligence pulses on AlienVault OTX, confirming its classification as a phishing threat. The page title, 'EcoSeed,' and the scam type labeled as 'Wallet/Seed Phishing' suggest the domain was designed to harvest cryptocurrency wallet credentials or seed phrases. The domain has since been taken offline, though its prior activity and infrastructure remain relevant for defensive measures.

Defenders are advised to block the domain at the DNS level and monitor for related indicators, including the IP address 18.245.86.42 and associated nameservers. The Gridinsoft trust score of 0/100 further corroborates the domain's malicious classification. While the exact content of the phishing page remains unanalyzed, the available evidence confirms its role in a wallet seed phishing scheme. Organizations should review logs for connections to this domain and assess potential exposure.