Análisis de phishing y seguridad de etherfi.name

etherfi.name was registered on 12 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to the Cloudflare‑owned address 188.114.96.3, and its authoritative nameservers are kelly.ns.cloudflare.com and trace.ns.cloudflare.com. The use of Cloudflare’s DNS infrastructure, together with Browser Insights and HTTP/3 support, indicates a modern hosting stack that can hide the true origin of any payload.

The TLS certificate presented by the site is issued by Google Trust Services under the WE1 designation, providing a valid HTTPS connection despite the underlying IP belonging to AS13335 (Cloudflare, Inc.) in the United States. An HTTP request to the root path returns a 403 status code and the page title “Just a moment…”, a pattern commonly observed in domains that employ Cloudflare’s challenge pages before delivering malicious content.

Threat intelligence flags etherfi.name as a high‑risk brand‑impersonation campaign targeting users of the EtherFi platform. VirusTotal has recorded a single positive detection out of 95 scanners, and the domain is listed on one external blocklist, where it has already been blocked by PhishDestroy. The classification as a crypto‑related scam aligns with the observed impersonation of the EtherFi brand and the active status of the domain.

Defenders should add etherfi.name to web‑filter deny lists and enforce DNS sink‑hole or block rules at the network perimeter. Continuous monitoring of Cloudflare‑associated IP ranges for similar newly created domains is advised, as the infrastructure can be reused for rapid deployment of additional impersonation sites. User‑facing communications should warn employees that any unsolicited requests appearing to originate from EtherFi may be fraudulent, and that the presence of a Cloudflare challenge page does not guarantee legitimacy.