explorer-reactor[.]mainnet[.]ethernal[.]work

The domain explorer-reactor.mainnet.ethernal.work is currently classified as a high-risk phishing threat and remains active. Evidence suggests this domain is being used to impersonate a legitimate service under the guise of a 'Reactor Mainnet Explorer.' Analysis shows that it has been flagged by 6 out of 95 security vendors on VirusTotal, indicating a notable concern regarding its authenticity. The domain was registered on March 13, 2026, through GoDaddy.com, LLC, which is often used for various domain registrations, including potentially malicious ones. Underlying technologies detected on the domain include Erlang and the Cowboy web server, which could be utilized to host dynamic web content but do not inherently indicate safety or security practices.

The domain resolves to the IP address 52.40.69.108, which is part of an Amazon infrastructure. Having an SSL certificate issued by Amazon could mislead users into believing that the site is secure, which is a common tactic in phishing schemes to appear legitimate. The domain has been blocked by two security solutions, PhishDestroy and BLP-Malware, and has a trust score of 0/100 on Gridinsoft, further reinforcing its status as a potential threat. Adding to the risk profile, it appears on two known security blocklists, which indicates a consensus in the security community regarding its malicious nature.

Defenders should prioritize blocking this domain across their networks and educate users about the risks associated with it. Users should be vigilant and avoid interactions with the site, especially in cases where sensitive information might be requested. It is advisable to monitor network traffic for any signs of communication with this domain, given its ongoing activity and the potential for data theft.