aterasigin[.]com

Analysis of aterasigin.com indicates a high-risk phishing domain registered on October 6, 2025, through NameCheap, Inc. The domain currently resolves to IP address 172.67.168.142, hosted on Cloudflare's network (AS13335) in the United States, with nameservers iris.ns.cloudflare.com and lennon.ns.cloudflare.com. As of July 25, 2026, the domain is offline, returning an HTTP 403 status and a page title of 'aterasigin.com | 525: SSL handshake failed,' suggesting SSL/TLS configuration issues or deliberate blocking by the hosting provider. The domain appears on four security blocklists and is flagged by 15 of 93 security vendors in VirusTotal scans, though the exact nature of the phishing content remains unconfirmed due to its offline status. AlienVault OTX records show the domain in 15 threat intelligence pulses, reinforcing its association with malicious activity.

The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's infrastructure. Scamadviser assigns a trust score of 1/100, further indicating high risk. Defenders should treat this domain as compromised infrastructure.

Block access at the network level, monitor for re-activation, and review logs for connections to 172.67.168.142 or related Cloudflare IPs. The domain's registration details, SSL provider, and hosting setup align with patterns observed in phishing campaigns, though the specific target or scam type is not yet identified. No evidence links this domain to a known phishing kit or branded impersonation.