etherfiwc26[.]org

etherfiwc26.org entered the PhishDestroy evidence set on Jun 22, 2026. The hostname explicitly references EtherFi; stored content metadata identifies the same apparent target. The stored content classification is brand impersonation. The assembled evidence scores 100/100 (critical).

Four independent sources are positive: VirusTotal, MetaMask, ScamSniffer, and SEAL. VirusTotal recorded 14 detections among 91 engines: BitDefender, CRDF, G-Data, Gridinsoft, Kaspersky on Jul 8, 2026 at 04:16 UTC. MetaMask, ScamSniffer, and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 14:20 UTC. The evidence is not unanimous. Google Safe Browsing returned no flag on Jun 22, 2026 at 11:20 UTC. URLScan completed without a malicious verdict (score 0) on Jun 22, 2026 at 11:19 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:58 UTC; content was unavailable. Registration records for the domain list Key-Systems GmbH as the registrar and Jun 17, 2026 as the creation date. Registration preceded first observation by 4 days. At collection time, the hostname resolved to 104.21.81.207 (AS13335 Cloudflare, Inc.). The recorded endpoint location is San Francisco, US. The stored server header is cloudflare. DOM analysis completed on Jun 22, 2026 at 14:20 UTC; stored DOM score 100/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:52 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

No page title was retained; the visual captures, not a title string, preserve the landing-page appearance. Taken together, the page content and independent findings support classifying this hostname as EtherFi-themed brand impersonation.