ethereum-4a0b7[.]genie[.]jellyjelly[.]com

The domain ethereum-4a0b7.genie.jellyjelly.com was identified as a brand impersonation threat specifically targeting Ethereum, the well-known blockchain platform. The domain's page title, "Ethereum — the world computer," closely mimics the official Ethereum website, designed to deceive visitors into believing they are accessing a legitimate Ethereum resource. This domain is currently offline, having been taken down following detection, but its past activity posed a significant risk to users who may have been tricked into providing sensitive information or downloading malicious content.

According to available data, the domain was flagged by 1 out of 95 security vendors on VirusTotal, indicating low but notable detection. It was registered through GoDaddy.com, LLC and created on November 13, 2007, which is unusually old for a phishing domain, possibly indicating a compromised or repurposed legitimate domain. The domain resolves to IP address 172.66.44.148 and uses an SSL certificate from Google Trust Services (WE1). It appears on three security blocklists, suggesting it has been associated with malicious activity. The risk level was assessed as elevated due to the combination of brand impersonation and the domain's age, which could lend it an air of legitimacy.

Currently, the domain is offline, which mitigates immediate risk. However, users who may have visited the site or entered credentials should change their passwords immediately and monitor accounts for suspicious activity. Security teams should add this domain to blocklists and educate users about verifying Ethereum URLs, as the official site is ethereum.org. PhishDestroy recommends remaining vigilant against similar domains that use slight variations of trusted brand names, as cybercriminals often register lookalike domains to conduct phishing campaigns.