aethir-2-20mr[.]4everland[.]app

On July 23, 2026, analysis of the domain aethir-2-20mr.4everland.app identified it as a confirmed crypto‑related phishing site. The domain resolves to IP 104.21.7.158, which belongs to AS13335 Cloudflare, Inc. and is located in the United States. The hosting provider is Cloudflare, as indicated by both the resolver and the authoritative nameservers cody.ns.cloudflare.com and saanvi.ns.cloudflare.com. The site presented the page title “Decentralised Cloud Infrastructure for Gaming & AI,” a generic description that does not correspond to any legitimate service known to be operated by the referenced brand, and the HTTP response code returned 410, indicating that the resource has been removed.

The SSL certificate was issued by Google Trust Services under the WE1 label, confirming the use of a valid TLS certificate despite the malicious intent. Security‑vendor scans on VirusTotal recorded 14 detections out of 95 scanners, and the domain appears on a single security blocklist. It has also been flagged by PhishDestroy and is listed with a Gridinsoft trust score of 0 out of 100. The presence of IPFS, Cloudflare and HTTP/3 technologies suggests the content was delivered via modern web infrastructure, potentially to evade simple content‑filtering rules.

The site is currently offline, as indicated by the “taken offline” status and the HTTP 410 response. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, because the page content has not been captured. Analysts should continue to monitor the IP address for any re‑use, enforce blocklisting of the domain and its associated IP in perimeter defenses, and update URL filtering and email security gateways to treat any future references as malicious. Given the crypto‑scam classification, organizations handling cryptocurrency transactions should be advised to treat any communications referencing this domain as fraudulent.