aethirrewards[.]live

This domain is flagged as a high-risk brand impersonation threat designed to deceive users into believing they are interacting with an official Discord rewards program. Analysis of the infrastructure reveals a targeted campaign leveraging social engineering tactics, specifically masquerading as an "Aethir Early User Reward" to exploit trust in the Discord platform. The threat type aligns with credential harvesting or potential cryptocurrency drainer activity, given the historical patterns of similar domains impersonating reward programs. Infrastructure analysis reveals the domain aethirrewards.live was registered on September 04, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.78.197, a common hosting provider for malicious infrastructure. The domain is flagged by 13 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. Google Safe Browsing classifies it under "SOCIAL_ENGINEERING," and it appears on six security blocklists, including Polkadot, Codeesura, PhishDestroy, ScamSniffer, and Enkrypt. The page title, "Home | Aethir Early User Reward," further confirms the impersonation of a legitimate rewards program, a tactic frequently used to lure victims into disclosing sensitive information or transferring assets. To mitigate risks associated with this threat, organizations and users should immediately block the domain and its resolving IP address (104.21.78.197) at the network level. Security teams should monitor for any attempts to access the domain or related infrastructure, particularly in environments where Discord or cryptocurrency-related activities are common. End-users should be educated on recognizing brand impersonation tactics, such as verifying domain authenticity through official channels and scrutinizing unsolicited reward offers. Additionally, enforcing multi-factor authentication (MFA) and disabling URL previews in messaging platforms can reduce the likelihood of successful exploitation.