app-nanoeth[.]com

Analysis indicates that the domain app-nanoeth.com, created on 12 March 2026 and registered through NiceNIC International Group Co., Limited, is presently offline but exhibits multiple indicators of malicious activity. DNS resolution points to IP address 151.101.64.155, which belongs to AS13335 Cloudflare, Inc. and is hosted in the United States. The domain is served by Cloudflare nameservers kayden.ns.cloudflare.com and magnolia.ns.cloudflare.com, yet it lacks an SSL/TLS certificate, leaving the connection unencrypted. The observed page title references “Cosmopolitan.com – The Women’s Magazine…”, a brand unrelated to the domain name, suggesting a possible attempt to lure users through brand impersonation.

Infrastructure fingerprinting reveals the use of Chart.js, Smartsupp, jsDelivr, Cloudflare Browser Insights, and HTTP/3, all common in legitimate sites but also frequently leveraged by threat actors to blend in with normal traffic. Threat intelligence classifies the activity as a crypto‑related scam, and the domain is listed on three independent security blocklists. Additional protective services, including PhishDestroy, MetaMask, and SEAL, have explicitly blocked the domain. VirusTotal scans report that two of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent.

The combination of a recent registration date, lack of TLS, mismatched brand content, and multiple blocklist entries aligns with patterns observed in fraudulent cryptocurrency campaigns. Uncertainty remains regarding the specific payload or victim interaction flow because the site is no longer reachable for direct inspection. Defenders should continue to deny any network requests to app‑nanoeth.com, update firewall and DNS filtering rules to block the associated IP and nameservers, and ensure that endpoint security solutions reference the known blocklist identifiers.