verify-t3rn[.]io

Analysis of the domain verify-t3rn.io confirms its classification as an active credential phishing site, operational as of July 12, 2026. The domain was registered on February 21, 2026, through NameSilo, LLC, and currently resolves to the IP address 104.21.42.63, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The use of Cloudflare nameservers (princess.ns.cloudflare.com and jaxson.ns.cloudflare.com) and Cloudflare-hosted infrastructure is consistent with tactics employed to obfuscate the true origin of phishing campaigns and evade detection. The domain presents a page titled 't3rn,' suggesting an attempt to impersonate the legitimate t3rn platform, though the exact content and mechanisms of the phishing kit remain unconfirmed. The site is flagged by two independent security blocklists (PhishDestroy and ScamSniffer), and Gridinsoft assigns it a trust score of 0/100, further supporting its malicious classification. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate to end users. VirusTotal analysis indicates that 2 of 93 security vendors detect this domain as malicious, though the absence of broader detection does not diminish its confirmed status as a phishing threat. The HTTP status code 200 confirms the site is accessible, and its continued operation underscores the need for immediate defensive action. Defenders should prioritize blocking the domain and its resolving IP (104.21.42.63) at the network level, while monitoring for related infrastructure leveraging the same registrar or hosting patterns. Given the domain's age and active status, it is likely part of a broader campaign targeting users of the t3rn ecosystem, though further forensic analysis would be required to determine the full scope of its distribution methods.