etherex[.]foundation

Analysis of etherex.foundation, created on February 21 2026, shows it was used to impersonate Discord in a social media phishing campaign. The site presented the page title "Dashboard - Etherex Exchange" and was secured with an SSL certificate identified as WE1. Infrastructure inspection reveals the domain resolved to IP address 188.114.97.3, located in the United States and associated with AS13335 Cloudflare, Inc. VirusTotal recorded a single positive detection out of ninety‑three scanners, indicating at least one vendor identified malicious behavior.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, confirming external threat intel corroborates its malicious nature. Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extremely low reputation. Current status is offline, suggesting the hosting service has been taken down or the site is otherwise inaccessible, yet remnants may persist in DNS caches or client systems that have previously resolved the address.

Defenders should continue to block the domain at network perimeter and endpoint filters, monitor for any resurgence of the IP or similar Cloudflare‑hosted assets, and consider adding the domain to internal allow‑list exclusions only after thorough verification. Further investigation is needed to determine the exact phishing kit employed, the content of the login interface, and whether additional infrastructure (command‑and‑control or credential‑harvesting endpoints) is linked to the same IP range. Continuous threat‑intel feeds should be consulted for updates, and any user reports of unsolicited Discord‑related communications referencing etherex.foundation should be escalated for incident response.