ethereum[.]attorney

This domain, ethereum.attorney, is actively impersonating Ethereum as part of a confirmed crypto scam operation. Infrastructure analysis reveals the domain was registered on March 7, 2026, through Squarespace Domains II LLC and resolves to 198.49.23.144 (AS53831 Squarespace, Inc., US). The site presents itself with the page title 'Ethereum.org: The complete guide to Ethereum,' directly mimicking the legitimate Ethereum brand. It is currently flagged by 3 security blocklists and appears in 23 threat intelligence pulses, indicating widespread detection as malicious. The domain employs Let's Encrypt SSL certification (R13) and utilizes technologies including Node.js, React, Next.js, and Cloudflare, which may be leveraged to obfuscate or enhance the scam's infrastructure. A 301 HTTP redirect is in place, which could be used to funnel victims to secondary malicious endpoints. While 3 of 94 security vendors on VirusTotal have flagged the domain, this does not represent a comprehensive assessment of its threat level. Defenders should treat this domain as high-risk due to its active status, confirmed brand impersonation, and association with crypto fraud. Immediate blocking at the DNS or network level is recommended, alongside monitoring for related domains registered under similar infrastructure or naming patterns. The exact content and mechanics of the scam remain unanalyzed, but the domain's intent is clear based on its branding and threat intelligence associations.