mail[.]eternldesktop[.]com

Analysis of mail.eternldesktop.com shows a domain that was registered on October 16, 2025 and is currently taken offline. The domain resolves to IP address 192.3.190.189, which belongs to AS36352 HostPapa and is geolocated in the United States. DNS resolution is served by four name servers: dns1.webproserver.com, dns2.webproserver.com, ns1.kanohost.com, and ns2.kanohost.com. No TLS certificate is presented for the site, indicating that connections would be made over plain HTTP if the service were active. The page title observed during the brief live period was "Eternl Cardano light wallet," which aligns with a crypto‑related theme rather than the advertised Discord brand.

The domain is listed on a single security blocklist and is specifically blocked by PhishDestroy, confirming that at least one reputable anti‑phishing feed has flagged it. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation of the host. VirusTotal reports a single detection out of 95 scanning engines, providing additional vendor corroboration of malicious intent. The registrar is Dominet (HK) Limited, a provider often associated with disposable or low‑cost registrations used in malicious campaigns. The threat profile is identified as a crypto scam that impersonates Discord, suggesting an attempt to lure victims with a familiar brand while directing them toward a fraudulent cryptocurrency wallet interface.

While the site is presently offline, the infrastructure – including the hosting provider, name server configuration, and lack of encryption – remains usable for future re‑deployment. Defenders should continue to block the domain and its associated IP, monitor the listed name servers for re‑use, and add the domain to internal blacklists. Network sensors should flag any outbound connections to 192.3.190.189, and email security gateways should inspect messages referencing Discord that contain links to this domain.