ww25[.]aethir[.]io

Analysis of the domain ww25.aethir.io indicates it is an active phishing site impersonating Aethir, a known entity in the cryptocurrency space, as evidenced by the page title 'aethir.io' and the classification as an 'Airdrop Scam' in available threat intelligence. The domain was registered on December 3, 2025, through CommuniGal Communication Ltd. and currently resolves to IP address 199.59.243.228, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The site employs a Let's Encrypt SSL certificate (YR1) and returns an HTTP 302 redirect status, a common tactic to obscure the final destination or evade detection. Infrastructure analysis reveals the domain uses nameservers ns15.abovedomains.com and ns16.abovedomains.com, which have been associated with other malicious domains in the past.

The domain appears on one security blocklist and is flagged by 3 of 95 security vendors on VirusTotal, though the specific detection logic is not publicly detailed. Gridinsoft assigns a trust score of 0/100, further supporting its malicious classification. The phishing kit in use is identified as an 'Airdrop Scam,' a technique often employed to deceive users into disclosing wallet credentials or transferring cryptocurrency under false pretenses. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS, proxy, or firewall level.

The use of a 302 redirect and a recently registered domain suggests an attempt to evade automated detection systems. No evidence of takedown or remediation has been observed as of July 24, 2026, and the domain remains active. Further investigation into the final redirect destination and associated wallet addresses is recommended to mitigate potential financial losses.