e[.]ther[.]finance

e.ther.finance is a subdomain of ther.finance. PhishDestroy first observed the hostname on Sep 17, 2025. The captured page title is “403 Forbidden”. Current evidence score: 58/100 (high).

Positive findings are stored from 2 sources: VirusTotal and ScamSniffer. VirusTotal recorded 2 detections among 95 engines: G-Data, Gridinsoft on Feb 23, 2026 at 05:37 UTC. ScamSniffer listed the hostname in the separate external-blocklist snapshot on Aug 8, 2026 at 10:20 UTC. Non-positive and contextual checks: URLQuery recorded no positive detection; no observation timestamp was retained. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:40 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:14 UTC; content was unavailable. At collection time, the hostname resolved to 82.25.81.58 on AS47583 (AS-HOSTINGER Hostinger International Limited, CY). The recorded endpoint location is Boston, US. The stored server header is hws. DOM analysis on Apr 23, 2026 at 19:24 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy and URLScan.

The content indicators and 2 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.