lerfgounw4366jho257rjgaqd35bkxrnihbxva52mklcikx6ofwa[.]arweave[.]net

The domain lerfgounw4366jho257rjgaqd35bkxrnihbxva52mklcikx6ofwa.arweave.net is registered through NameCheap, Inc. and was created on January 25, 2018. Current WHOIS data shows the domain remains active. Infrastructure analysis reveals that the domain resolves to the IPv4 address 212.102.56.179 and is served by Cloudflare nameservers aurora.ns.cloudflare.com and nitin.ns.cloudflare.com.

The domain is listed on two security blocklists and has been flagged by the detection services PhishDestroy and ScamSniffer, indicating that these vendors have observed malicious activity associated with the host. No public evidence of SSL certificates, Safe Browsing status, OTX entries, or page title information is available, so the content of the site has not been directly analysed. The lack of additional telemetry suggests that the campaign may rely on the underlying arweave.net infrastructure to host phishing payloads, leveraging the persistence of the Arweave network.

Defenders should consider adding the IP address 212.102.56.179 and the full domain to perimeter blocklists, monitor DNS queries for the sub‑domain pattern, and enforce outbound filtering to prevent credential harvesting. Continuous re‑evaluation is advised, as the threat remains active and under investigation.