erebusprotocol[.]network

The domain erebusprotocol.network was observed on July 12, 2026 as an active generic phishing site. The only visible page title is the German phrase “Nur einen Moment…”, which suggests a waiting or redirect page but no further content has been disclosed. Infrastructure analysis shows the domain resolves to the address 198.18.0.214, which is hosted within the Cloudflare network (AS13335). Both authoritative nameservers, meilani.ns.cloudflare.com and zahir.ns.cloudflare.com, are Cloudflare‑provided, confirming the use of Cloudflare’s DNS and edge services. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint. HTTP requests return a 403 status code, and the site advertises Cloudflare Browser Insights and HTTP/3 support. Reputation data places the domain on a single security blocklist and records two detections out of ninety‑five scanning engines on VirusTotal. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low confidence in legitimacy. PhishDestroy has already blocked the domain, reinforcing the high‑risk classification despite the modest detection count. Given the combination of a Cloudflare‑fronted IP address, a valid certificate, and the “Nur einen Moment…” title, the site likely functions as a short‑lived redirect used to harvest credentials or deliver malicious payloads. Defenders should add the domain to blocklists, monitor DNS queries for the associated IP, and enforce web filtering rules that deny connections to the domain. Continuous re‑scanning on multi‑engine platforms is advised to capture any evolution in payload or infrastructure.