thierryarts[.]com

The domain thierryarts.com, created on 07 Nov 2018 and currently taken offline, has been identified as a crypto‑scam impersonating the brand “base.” Infrastructure analysis shows the domain resolves to IP 104.21.51.31, which is owned by Cloudflare (AS13335) and located in the United States. DNS is served by the Cloudflare nameservers iris.ns.cloudflare.com and karl.ns.cloudflare.com, and the site used a Google Trust Services / WE1 SSL certificate, indicating that TLS termination was performed at Cloudflare. The web stack was detected as Node.js running Vue.js and Nuxt.js, with HTTP/3 enabled, confirming a modern server‑side JavaScript environment behind the Cloudflare edge.

The page title returned during the brief scan was “ThierGalerie,” but no further content analysis is available because the site is no longer reachable. Security telemetry lists a single block on PhishDestroy and a presence on one additional security blocklist, and VirusTotal recorded a single positive detection out of 93 AV engines, reinforcing the suspicion of malicious activity. The domain’s Gridinsoft trust score of 0 / 100 further corroborates its classification as unsafe.

Defenders should immediately add thierryarts.com to network‑wide deny lists, monitor its DNS records for any reactivation, and watch for new domains registered with the same registrar (GoDaddy) or using the same Cloudflare nameservers that exhibit similar JavaScript frameworks. Because the underlying IP is a shared Cloudflare address, broader IP‑based blocking may cause collateral impact; therefore, emphasis should be placed on domain‑level controls and threat‑intel feeds that reference the identified SSL certificate and page‑title signature. Continuous correlation of future alerts against the “ThierGalerie” title and the Google Trust Services certificate fingerprint is advised to catch any resurgence of the campaign.