etherfi-v4[.]com

Analysis as of July 19, 2026 flags etherfi-v4.com as an active generic phishing infrastructure. The site returns an HTTP 301 redirect and presents the page title "etherfi-v4.com | 523: Origin is unreachable," indicating that the landing page is currently inaccessible or deliberately obscured. TLS termination is provided by Google Trust Services / WE1, and the domain resolves to Cloudflare IP 104.21.7.106 located in Canada. Registration records show the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the authoritative nameservers are carrera.ns.cloudflare.com and trace.ns.cloudflare.com. The domain is listed on at least one public blocklist and has been identified in two AlienVault OTX pulses, suggesting prior use in malicious campaigns. VirusTotal scans report five detections out of ninety‑one vendors, confirming that multiple security products have flagged the host as suspicious. PhishDestroy has already blocked the domain, reinforcing its malicious reputation. While the exact victim brand or credential‑stealing template has not been disclosed, the infrastructure characteristics—Cloudflare fronting, a Google‑issued certificate, and repeated detection by threat feeds—are consistent with typical phishing deployments. Defenders should add etherfi-v4.com to URL filtering and sinkhole lists, monitor for outbound connections to the IP address 104.21.7.106, and enforce TLS inspection to capture any hidden payloads. Continuous re‑evaluation is recommended, as the site may become active again or serve additional malicious content.