multiplier-ether[.]com

Analysis of multiplier-ether.com shows a newly registered domain (creation date 27 February 2026) that was taken offline shortly after detection. The authoritative nameservers are carl.ns.cloudflare.com and lara.ns.cloudflare.com, indicating the site was hosted behind Cloudflare’s edge network (AS13335, United States). DNS resolution points to IP address 188.114.96.3, an address owned by Cloudflare, which is commonly used by malicious actors to hide infrastructure. No TLS certificate was presented, meaning the site operated without HTTPS encryption, a characteristic often observed in fast‑flux or throwaway phishing deployments. The page title retrieved from the live host before takedown reads "Save, Grow, Spend.

Do more with your crypto | ether.fi," aligning with the declared scam type of a crypto‑related phishing campaign. Registration was performed through NiceNIC International Group Co., Limited, a registrar that has hosted other abusive domains in the past. VirusTotal reports that two out of ninety‑three scanning engines flagged the domain, providing independent confirmation of malicious intent. The domain also appears on a single external blocklist and has been catalogued by the PhishDestroy feed as a confirmed crypto scam. While the limited number of vendor detections suggests the site may have been short‑lived, the combination of a targeted crypto‑oriented title, lack of SSL, Cloudflare front‑end, and blocklist presence constitutes strong evidence of phishing activity aimed at deceiving cryptocurrency users.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanism because no page content beyond the title has been captured. Defensive operators should immediately block multiplier-ether.com at perimeter firewalls, DNS filters, and endpoint security solutions. Continuous monitoring of the associated IP address and related Cloudflare edge nodes is advised, as malicious actors may reuse the infrastructure for future campaigns.