mail[.]etherchain[.]world

Analysis of the domain mail.etherchain.world indicates active phishing infrastructure targeting cryptocurrency users. Registered through Cloudflare, Inc. and resolving to IP 188.114.97.3 (AS13335, United States), the domain is flagged by 10 of 95 security vendors on VirusTotal as malicious, with a specific classification of 'crypto scam.' The domain appears on one security blocklist and is currently blocked by PhishDestroy. The page title 'Nur einen Moment…' suggests a temporary or transitional page, commonly used to mask phishing content or redirect users to fraudulent portals. HTTP status 403 (Forbidden) may indicate restricted access or server-side filtering, while the SSL certificate issued by Google Trust Services (WE1) is consistent with legitimate domains but does not preclude malicious use. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which are frequently leveraged to obfuscate hosting origins and evade detection. The domain's trust score of 0/100 further supports its classification as high-risk. While the exact content of the phishing page remains unconfirmed, the 'crypto scam' designation implies an attempt to harvest credentials, private keys, or other sensitive information from cryptocurrency wallet users. Defenders should treat this domain as active and malicious, blocking resolution at the DNS level and monitoring for related infrastructure. Further investigation into associated domains or IPs may reveal broader campaign activity.