ether[.]fi-app-cash[.]com

Analysis of ether.fi-app-cash.com indicates that the domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is presently taken offline. The authoritative nameservers are hunts.ns.cloudflare.com and mona.ns.cloudflare.com, confirming that the domain is hosted behind Cloudflare’s edge network and supports HTTP/3. VirusTotal records show that 2 of 93 security vendors have flagged the domain, reflecting limited but non‑zero detection.

The domain appears on a single public blocklist and is actively blocked by the PhishDestroy service, which further corroborates its malicious disposition. The sole page title returned by the live endpoint is “404 Not Found,” suggesting that the site is no longer serving content, consistent with the reported offline status. The intelligence categorises the campaign as a crypto scam, although no specific wallet addresses or transaction details have been disclosed.

At present, no additional indicators such as IP address, SSL certificate details, or Safe Browsing verdicts are available, leaving those facets of the infrastructure unverified. Defenders should update domain‑based threat feeds to include ether.fi-app-cash.com, enforce blocklist rules that reference the known nameservers, and monitor for any resurrection of the domain or related sub‑domains that may reuse the same Cloudflare configuration. Given the limited vendor detections, continued observation is advisable to capture any future activity that could expand the campaign’s footprint.