ethndoe[.]cc

This domain, ethndoe.cc, is identified as a cryptocurrency-focused phishing site designed to deceive users into disclosing wallet credentials or private keys. Analysis indicates no direct association with a specific blockchain brand, though the infrastructure aligns with generic wallet-drainer kits commonly deployed in credential harvesting campaigns. The site’s design and functionality suggest intent to capture sensitive authentication details, likely redirecting victims to attacker-controlled addresses for immediate fund extraction. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 24, 2026, through Gname.com Pte. Ltd., and currently resolves to IP address 172.67.132.55, hosted on Cloudflare’s network (AS13335). Google Safe Browsing classifies the domain as phishing, while VirusTotal reports 16 out of 95 security vendors flagging it as malicious. The domain appears on three security blocklists, and its SSL certificate is issued by Google Trust Services (WE1). The page title, ethndoe.cc/, provides no additional contextual clues beyond the domain name itself. As of the latest verification, ethndoe.cc has been taken offline, likely due to enforcement actions by security providers or hosting interventions. Despite its current inactive status, residual risk persists for users who may have interacted with the domain prior to its removal. Organizations are advised to update blocklists with the domain and IP, monitor for related infrastructure, and educate users on recognizing cryptocurrency phishing attempts. The use of Cloudflare hosting and a recently registered domain underscores the need for continuous vigilance against evolving phishing tactics in the cryptocurrency ecosystem.