club-etherfi[.]net

This domain, club-etherfi.net, is actively flagged as a high-risk phishing site targeting cryptocurrency users, specifically those interacting with the Ether.fi ecosystem. Analysis indicates the domain was registered on April 18, 2026, through a registrar known for hosting fraudulent infrastructure, and it currently resolves to a Cloudflare IP address (188.114.97.3) located in Canada. The site presents a Cloudflare challenge page with the title 'Just a moment...', a common tactic to delay or obscure malicious content from automated security scans while remaining accessible to targeted users. Infrastructure analysis reveals the domain is protected by Cloudflare nameservers (demi.ns.cloudflare.com and eoin.ns.cloudflare.com) and uses a Let's Encrypt SSL certificate, which provides encryption but does not validate the legitimacy of the site. The domain appears on three security blocklists, including PhishDestroy and MetaMask, and has been documented in at least one threat intelligence pulse on AlienVault OTX. Despite a current VirusTotal detection score of 0/95, this metric alone does not confirm safety, as phishing sites often evade initial detection by rotating content or employing cloaking techniques. The combination of a recent registration date, use of a registrar frequently associated with malicious domains, and active blocklisting by cryptocurrency-focused security tools strongly suggests this site is part of a phishing campaign. Defenders should treat this domain as compromised and prioritize blocking it at the DNS and proxy levels. Monitoring for related subdomains or IP shifts is recommended, as threat actors often migrate infrastructure to evade takedowns. Given the domain's association with Ether.fi branding, users should be alerted to verify URLs carefully before interacting with any Ether.fi-related services.