receive-nanoeth[.]net

On 24 July 2026 the domain receive-nanoeth.net was observed hosting a site whose HTML title reads “/Film | Movie & TV News, Trailers, Interviews, & Reviews”. The page title does not correspond to any known legitimate brand, and the domain has been classified as a crypto‑scam infrastructure. The domain was registered on 2 March 2026 through NiceNIC International Group Co., Limited and is served via Cloudflare’s DNS (kevin.ns.cloudflare.com, zara.ns.cloudflare.com). DNS resolution points to IP address 104.21.55.42, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented, indicating the site was served over plain HTTP.

VirusTotal has recorded four detections out of ninety‑three scanners, confirming that at least a minority of security products flag the domain as malicious. The domain appears on three external blocklists and is currently blocked by PhishDestroy, MetaMask, and SEAL, suggesting that active threat‑intel feeds have incorporated it. The site’s status is listed as offline at the time of reporting, which may be a temporary takedown or a deliberate shutdown after detection. Because the content of the landing page has not been captured, the exact luring technique and any credential‑harvesting forms remain unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same host name or its IP address, and add the IP 104.21.55.42 to threat‑intelligence feeds.

Given the Cloudflare hosting, future variants may appear on different sub‑domains or use the same CDN edge. Regular re‑scanning of the domain, especially if it re‑appears, is recommended to capture any changes in detection rate. Organizations that handle cryptocurrency transactions should be advised to treat any unsolicited communications referencing this domain as malicious and to educate users about the lack of a valid SSL certificate.