vote-ethfi[.]app

This domain, vote-ethfi.app, is identified as a crypto drainer site specifically designed to impersonate the legitimate ether.fi platform. The page title, 'ether.fi — $ETHFI Rewards Distribution,' directly mimics the branding and reward distribution announcements of the authentic ether.fi project, a known staking protocol in the Ethereum ecosystem. Analysis indicates the site likely employs a cryptocurrency drainer kit, tricking users into connecting wallets under the guise of claiming rewards, which results in unauthorized fund transfers. Infrastructure analysis reveals the domain was registered on June 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and currently holds a Gridinsoft trust score of 0 out of 100. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is commonly exploited by threat actors to lend a false sense of legitimacy to phishing infrastructure. As of the latest verification, vote-ethfi.app has been taken offline, mitigating immediate user exposure. However, the domain remains registered, and the infrastructure could be reactivated or repurposed. Users who interacted with the site are advised to revoke any connected wallet permissions and monitor accounts for unauthorized transactions. The continued registration of the domain and the use of a low-reputation registrar suggest residual risk, warranting ongoing monitoring of related infrastructure.