event-ethereal[.]trade

The domain event-ethereal.trade was registered on April 13, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. It is delegated to the Cloudflare nameservers josephine.ns.cloudflare.com and troy.ns.cloudflare.com, and resolves to the IPv4 address 188.114.97.3, which is geolocated to Canada and belongs to Cloudflare, Inc. The site presents a TLS certificate issued by Let’s Encrypt (E8) and returns an HTTP 403 response whose page title is “Just a moment…”.

Security telemetry assigns the domain a high risk rating. Gridinsoft gives it a trust score of 0 out of 100. The domain appears on three independent security blocklists and has been cited in one AlienVault OTX pulse. VirusTotal analysis shows that two of ninety‑five scanned security vendors flagged the domain as malicious. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL.

The observed indicators are consistent with a generic phishing campaign. The 403 status and the “Just a moment…” title suggest a Cloudflare challenge page commonly used to hide malicious landing pages. No additional infrastructure such as command‑and‑control servers or payload URLs has been exposed, leaving the exact phishing content and target brand unclear. The short lifespan of the domain, combined with the rapid deployment of blocklist entries, points to a fast‑flux style operation designed to evade detection.

Defenders should immediately block event-ethereal.trade at DNS and network perimeter filters, and ensure that the associated IP address 188.114.97.3 is added to threat intelligence feeds. Continuous monitoring of Cloudflare name server changes is advised, as the attacker may shift to alternative addresses. Organizations should also inspect outbound traffic for attempts to resolve the domain and consider tightening email gateway rules to catch potential phishing messages that reference the domain.