user[.]ecosminers[.]net

The domain user.ecosminers.net was registered on March 24, 2026 through Amazon Registrar, Inc. and resolves to the Cloudflare‑hosted address 188.114.97.3, which maps to a Cloudflare, Inc. location in Canada. The site presents an HTTP 302 redirect and serves a TLS certificate issued by Google Trust Services under the WE1 label, with HSTS enforced. Infrastructure analysis shows the domain is served by Cloudflare nameservers (ram.ns.cloudflare.com, veda.ns.cloudflare.com) and utilizes modern web stacks including Bootstrap, Vue.js, Slick, jQuery, Cloudflare Browser Insights, and HTTP/3. Reputation metrics are low, with Gridinsoft assigning a trust score of 35 / 100, Scamadviser a score of 16 / 100, and the domain appearing on a single security blocklist. VirusTotal scans have flagged the domain by four of ninety‑four security vendors, and it is actively blocked by PhishDestroy. The page title "Ecos Cloud Mining - Sign In" indicates a credential‑phishing campaign targeting users of an ecosystem‑related cloud mining service, though the exact target brand is not confirmed beyond the title. Current evidence confirms the domain is active and high‑risk; however, detailed content analysis of the landing page is not available. Defenders should immediately block user.ecosminers.net at perimeter defenses, enforce DNS sink‑hole rules for its IP address, and monitor for related Cloudflare‑served subdomains. Continuous threat‑intel updates are recommended to capture any future changes to the hosting configuration or additional detections from security vendors.