eternalwealths[.]com

The domain eternalwealths.com was registered on 13 March 2026 through OwnRegistrar, Inc. and is currently hosted on IP 185.162.11.65, which resolves to EuroHoster Ltd. in the Netherlands. The server presents a Let’s Encrypt R12 certificate and responds with an HTTP 303 redirect. DNS is served by ns1.e-ns.org and ns2.e-ns.org. Technical fingerprinting shows the presence of a Plesk control panel, an Nginx web server, and a Facebook Pixel embedded in the page. The visible page title reads “AIA Coin 🇬🇧”, which is unrelated to any legitimate service and aligns with the observed investment‑scam narrative.

Multiple security products have already flagged the site. It appears on three independent blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. Google Safe Browsing lists it under the SOCIAL_ENGINEERING category, and VirusTotal records 15 of 95 scanners marking the domain as malicious. The Gridinsoft trust score is 0 out of 100, reinforcing the classification of an investment scam. The combination of a seemingly innocuous cryptocurrency‑style title, the use of a Facebook tracking pixel, and the redirection behavior suggests an attempt to harvest credentials or lure victims into a fraudulent financial scheme.

At present, no payload or malware sample has been publicly released, leaving the exact compromise vector uncertain. Nonetheless, the infrastructure evidence points to a deliberately crafted phishing front‑end intended to exploit interest in cryptocurrency investments. Defensive teams should immediately block resolution of eternalwealths.com and its associated IP address, enforce URL filtering for the observed page title patterns, and monitor outbound connections to the identified nameservers. Continuous re‑evaluation of VirusTotal and other multi‑scanner feeds is advised, as additional detections may emerge as the campaign evolves.