ethereumwlet[.]webflow[.]io

On July 23, 2026, the domain ethereumwlet.webflow.io was observed hosting a page titled “Ethereum wallets”. The site is currently offline and returns HTTP 404, but historical data indicate it was used to impersonate the Ethereum brand in a crypto‑scam campaign. The domain resolves to IP 172.64.151.8, which belongs to Cloudflare (AS13335) in the United States. Cloudflare’s HTTP/3 service and a Google Trust Services certificate (WE1) were present, suggesting the attacker leveraged legitimate CDN infrastructure to obtain a trusted TLS handshake.

Registration information shows the domain was created on 08 May 2013 and is listed under the MarkMonitor registrar, a service often used for legitimate brand protection; this mismatch may indicate a compromised or abused account. Reputation checks are extremely poor: Scamadviser assigns a trust score of 1/100, and Google Safe Browsing flags the site for social engineering. VirusTotal records 15 of 95 scanning engines flagging the domain, and it appears on at least one public security blocklist, where PhishDestroy has already taken it down. The page title and the label “Crypto Scam” in the intelligence confirm the intent to lure victims into providing Ethereum‑related credentials or payments.

However, no screenshots, credential‑harvesting forms, or redirect chains have been published, leaving the exact malicious flow unknown. Defenders should block the domain and its resolving IP at perimeter firewalls, DNS resolvers, and proxy layers, and add both nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) to threat‑intel feeds. Continuous monitoring of Cloudflare‑hosted assets for new subdomains that reference “Ethereum” is recommended, as the attacker may reuse the same infrastructure for future campaigns. Incident response teams should treat any alerts referencing ethereumwlet.webflow.io as high‑confidence indicators of a crypto‑social‑engineering attempt.