frontend-stage[.]togetherfun[.]4irehub[.]uk

The domain frontend-stage.togetherfun.4irehub.uk is currently active and classified as a high‑risk generic_phishing site delivering a crypto‑scam campaign. Infrastructure analysis shows the domain resolves to 13.213.194.226, an Amazon Web Services EC2 instance in the ap‑southeast‑1 region of Singapore. The host is fronted by Cloudflare, using the nameservers thea.ns.cloudflare.com and vern.ns.cloudflare.com, and presents a Let's Encrypt R13 certificate with HSTS enabled. The web stack consists of Node.js, React, Next.js and Webpack, indicating a modern JavaScript application. The page title reported by crawlers is “Together.fun”, and the domain was registered on 28 March 2026 through Cloudflare, Inc. VirusTotal scans have flagged the domain by four of ninety‑four vendors, and Gridinsoft assigns a trust score of zero out of one hundred. The site is already listed on a security blocklist and has been blocked by the PhishDestroy service. Uncertainty remains around the exact phishing payload and whether additional malicious infrastructure is linked to the same IP address. Defenders should block the domain and its resolved IP at perimeter firewalls, update DNS filtering policies to include the domain, and monitor for any traffic to the associated AWS host. Continuous re‑scanning with multi‑engine services is advised to capture any new detections, and incident response teams should treat any credential or cryptocurrency transactions originating from this domain as compromised.