ethai[.]club

The domain ethai.club was registered on February 04, 2025 through Domain International Services Limited and currently resolves to the IP address 188.114.97.3, which is part of AS13335 Cloudflare, Inc. and geolocated to the United States. No SSL certificate is presented for the host, indicating that traffic is unencrypted. The site’s HTML title reads “Web3.0--Stock--Forex--ETF”, and the intelligence tags the operation as a crypto‑scam that impersonates the Coinbase brand. The domain is listed with a Gridinsoft trust score of 0 out of 100, and it has been added to at least one security blocklist, with PhishDestroy confirming the block.

The domain’s status is reported as offline at the time of analysis, and it appears on a single blocklist. VirusTotal scanned the site with 95 engines and reported no detections; however, the absence of detections does not constitute confirmation of safety. The lack of an SSL certificate, the low trust score, and the association with a known crypto‑scam brand suggest malicious intent, despite the current offline state.

Uncertainty remains regarding the exact content that was served before takedown, as no visual or functional analysis has been performed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration or similar domains, and incorporate the indicator set (domain name, IP address, registrar, and associated blocklist entries) into threat‑intel feeds. Ongoing surveillance of the IP range and Cloudflare‑associated infrastructure is recommended to detect potential reuse for future campaigns.