aetherionexchange[.]biz

Analysis of aetherionexchange.biz shows a high‑risk brand‑impersonation operation targeting users seeking CFD trading services. The domain was registered on September 01, 2025 through Global Domain Group LLC and resolves to the IP address 198.23.193.170, which is assigned to AS36352 (HostPapa) in the United States. DNS resolution uses the authoritative nameservers ns1.geebytescloud.com and ns2.geebytescloud.com. The site presents a valid TLS certificate issued by Let’s Encrypt (E7) but responds with an HTTP 302 redirect, a pattern often used to forward victims to malicious payloads. The page title advertised as "Aetherion Exchange | CFD Trading — Trading on Stocks, Gold, Oil, Indices" aligns with the classified scam type of a fake exchange, confirming the intent to impersonate legitimate trading platforms across the financial sector. Threat intelligence sources corroborate the activity: AlienVault OTX lists the domain in one pulse, PhishDestroy has already blocked it, and it appears on a security blocklist. VirusTotal reports that 4 of 95 scanners flagged the domain, while reputation services assign a Scamadviser trust score of 1/100 and a Gridinsoft score of 0/100, indicating extremely low credibility. The evidence base is limited to infrastructure and reputation data; the actual page content beyond the title has not been examined, leaving the precise phishing vector uncertain. Defenders should immediately block the domain and its resolving IP at perimeter and endpoint controls, add the nameservers to monitoring lists, and incorporate the indicator set (domain, IP, ASN) into threat‑intel feeds. Continuous monitoring for related hostnames and traffic patterns is advised, as the infrastructure could be leveraged for additional fraudulent campaigns.