e[.]uler[.]run

The domain e.uler.run was registered on November 17, 2025 through NiceNIC International Group Co., Limited and currently resolves to the IPv6 address 2a06:98c1:3120::3, which is hosted by Cloudflare, Inc. (AS13335) in the United States. The site is served without an SSL certificate and presents the generic directory listing page title "Index of /". Infrastructure analysis shows the domain is delegated to the Cloudflare nameservers maciej.ns.cloudflare.com and saanvi.ns.cloudflare.com, a common configuration for rapidly provisioned malicious sites.

Reputation checks indicate a Gridinsoft trust score of zero out of one hundred, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already taken the site offline. VirusTotal scans report that seven of ninety‑five antivirus and URL‑reputation engines flag the domain, providing additional corroboration of malicious intent. No additional detection vendors, Safe Browsing entries, or Open Threat Exchange (OTX) references are present in the supplied intelligence.

The lack of an SSL certificate, combined with the low trust score and blocklist inclusion, strongly suggests the domain was used for credential harvesting or similar phishing activity, although the exact target brand or campaign details have not been disclosed. Defenders should continue to block e.uler.run at the DNS and firewall layers, monitor traffic to the associated Cloudflare IPv6 address for any residual activity, and consider adding the domain to internal threat‑intel feeds. Because the site is already offline, ongoing vigilance is required to detect any re‑hosting attempts that may reuse the same registrar or nameserver configuration.