etricearn[.]com

The domain etricearn.com was registered on May 25, 2025 through Dynadot LLC. DNS resolves to IP 192.3.141.252, which is announced by AS36352 (HostPapa) located in the United States. The site presents a valid Let's Encrypt R12 certificate, indicating HTTPS is active. HTTP requests return status 200. The page title observed is “Etricearn”, and the site is flagged as impersonating the Ethereum brand. Infrastructure analysis shows the presence of PHP, Google Maps, YouTube, Bootstrap, LiteSpeed, Smartsupp, OWL Carousel, and jQuery, suggesting a typical content‑driven site rather than a specialized phishing kit. Reputation services assign extremely low trust scores: Gridinsoft 0/100, Scamadviser 1/100, and the domain appears on one blocklist (PhishDestroy). VirusTotal scans report 4 of 95 security vendors flagging the domain, indicating some detection of malicious activity. MX records point to the same host, which is unusual for a legitimate service and may be used for credential harvesting. The combination of brand‑impersonation intent, low trust scores, active blocklisting, and partial malicious detections qualifies the domain as high‑risk. However, the specific payload or user‑interaction flow has not been publicly disclosed, so the exact method of compromise remains uncertain. Defenders should add etricearn.com to domain blocklists, monitor DNS queries for the associated IP address, and enforce TLS inspection to capture any potential data exfiltration. Network traffic to the identified IP should be logged and subjected to heuristic analysis. Continuous re‑evaluation is advised should additional indicators emerge.