ehteruem[.]org

Analysis of the domain ehteruem.org confirms its classification as a cryptocurrency airdrop phishing site, targeting users with fraudulent token distribution schemes. The domain was registered on March 17, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals Cloudflare-hosted nameservers (johnathan.ns.cloudflare.com and sneh.ns.cloudflare.com) and resolution to the IP address 172.67.128.171, part of AS13335 (Cloudflare, Inc.) in the United States. The site lacks a valid SSL certificate, as indicated by the page title 'ehteruem.org | 526: Invalid SSL certificate,' a common red flag for phishing infrastructure. Detection data from security vendors is limited but indicative: four of ninety-three engines on VirusTotal flagged the domain at the time of assessment, and it appears on at least one security blocklist.

The domain was actively blocked by PhishDestroy, further corroborating its malicious status. Gridinsoft assigned a trust score of 0/100, reflecting high-risk characteristics. While the exact content of the phishing kit is not fully analyzed, available intelligence classifies it as an 'Airdrop Scam,' suggesting an attempt to deceive users into connecting wallets or disclosing private keys under the guise of a token giveaway. Defenders should treat this domain as confirmed malicious infrastructure.

The absence of SSL, use of Cloudflare for obfuscation, and registration through a high-risk registrar align with known phishing tactics. Network-level blocking is recommended, particularly for organizations handling cryptocurrency transactions or wallet services. Given the domain's current offline status, continuous monitoring for reactivation is advised, as phishing actors frequently re-enable such sites after brief takedowns.