aethir[.]click

This domain, aethir.click, is identified as a generic phishing infrastructure targeting cryptocurrency users. Analysis indicates no direct association with legitimate brands, though the naming convention mimics decentralized token projects. The site employs a basic frontend stack (Tiny Slider, cdnjs) and operates behind Cloudflare, a common tactic to obscure hosting origins and evade detection. No explicit drainer kit signatures were observed, but the presence of Cloudflare Browser Insights suggests tracking mechanisms for user interaction data, likely used to refine phishing lures or harvest credentials. Infrastructure analysis reveals the domain was registered on August 17, 2024, through HOSTINGER operations, UAB, and resolves to the IP address 198.18.0.122. It holds a VirusTotal detection score of 7/95, with three independent security blocklists listing it as malicious. The SSL certificate is issued by Google Trust Services, a legitimate provider often abused by threat actors to lend false credibility. Gridinsoft assigns a trust score of 0/100, while Scamadviser rates it 15/100, further corroborating its fraudulent nature. No entries were found in Google Safe Browsing at the time of analysis, indicating either recent deployment or evasion techniques. The domain is currently offline, likely due to takedown actions by hosting providers or security vendors. However, the infrastructure remains a residual risk, as the domain registration persists and could be repurposed for future campaigns. Users who interacted with the site should assume credential exposure and revoke access to any linked wallets or accounts. Organizations are advised to monitor for related domains using the same registrar or IP range, as threat actors frequently rotate infrastructure to sustain operations.