ethermail[.]social

Analysis indicates that ethermail.social is currently active and has been classified as a generic phishing site. The domain resolves to Cloudflare nameservers vicky.ns.cloudflare.com and isabel.ns.cloudflare.com, which are commonly used by malicious operators to obscure hosting location. VirusTotal records show that 6 out of 91 scanned security vendors flagged the domain as malicious, providing independent confirmation of suspicious activity. The registrar listed for the domain is NICENIC INTERNATIONAL GROUP CO., LIMITED, a known bulk registration service that frequently appears in abuse reports.

The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one industry‑wide mitigation service has taken protective action. HTTP probing returned a 302 redirect response, a technique frequently employed to forward victims to credential‑harvesting pages or to evade simple URL‑based filters. No SSL/TLS certificate details, page title, or content snapshot are available in the current intelligence set, so the exact landing page and any brand‑specific lures remain unknown. Consequently, the full scope of the phishing campaign, including any targeted brands or credential collection mechanisms, cannot be determined at this time.

Given the high risk rating, defenders should add ethermail.social to deny‑list configurations at the DNS, proxy, and email gateway layers. Continuous monitoring of outbound traffic for connections to the Cloudflare nameservers associated with this domain is advised, as is periodic re‑scanning with VirusTotal or similar multi‑engine services to capture any changes in detection status. Organizations should also consider user‑education reminders about unsolicited communications that request login credentials, especially those that reference “ethermail” or related phrasing, to reduce the likelihood of successful credential harvesting.