ettherscin[.]net

ettherscin.net was registered on 18 June 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain is delegated to Cloudflare name servers colin.ns.cloudflare.com and naya.ns.cloudflare.com, and resolves to the IP address 172.67.171.54, which belongs to the Cloudflare edge network. Current DNS queries show the domain remains active. Threat intelligence indicates the site is being used for generic phishing; it appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

VirusTotal analysis reports that one of ninety‑one scanners flagged the domain, reinforcing the suspicion of malicious activity. No additional public reputation services, Safe Browsing checks, or OTX entries are available for this domain at the time of analysis. The limited detection footprint—only one blocklist entry and a single vendor flag—does not diminish the observed risk, given the recent creation date, use of a reputable CDN for obfuscation, and the confirmed block by a dedicated anti‑phishing platform. The absence of further contextual data such as page title, target brand, or observed payload means the precise phishing vector remains uncertain, but the existing indicators are sufficient to classify the domain as high‑risk.

Defenders should add ettherscin.net to network deny lists and DNS sinkhole rules, monitor for outbound connections to 172.67.171.54, and enforce email filtering that blocks URLs containing the domain. Continuous re‑inspection of the domain’s content and reputation should be performed, as the threat actor may modify the payload or host additional malicious pages. Organizations that have observed phishing attempts referencing this domain should treat them as compromised and initiate standard incident response procedures.