voting-ethfi[.]app

This domain, voting-ethfi.app, is currently flagged as an active phishing site targeting Ethereum staking participants. The infrastructure impersonates ether.fi, a legitimate Ethereum liquid staking protocol, by presenting a fraudulent $ETHFI rewards distribution interface. Analysis confirms the domain remains operational despite multiple security interventions, posing a significant credential and asset theft risk to cryptocurrency users. Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, an offshore registrar frequently associated with high-risk domains. The site resolves to IP address 188.114.96.3 and is secured by a Google Trust Services SSL certificate (WE1), which may lend false legitimacy to unsuspecting visitors. Security vendors have flagged the domain in 2 of 95 VirusTotal scans, while three independent blocklists—including PhishDestroy and SEAL—have classified it as malicious. The page title, ether.fi — $ETHFI Rewards Distribution, directly mimics the branding of the legitimate ether.fi platform, increasing the likelihood of successful social engineering attacks. Current status indicates the domain remains active and accessible, with no evidence of takedown or mitigation. The combination of offshore registration, recent creation date, and targeted impersonation of a high-value DeFi service elevates the risk profile. Organizations and individuals are advised to implement immediate network-level blocking of the domain and associated IP address. End users should verify all staking reward claims through official ether.fi channels and avoid interacting with any unsolicited reward distribution prompts. Enhanced monitoring of cryptocurrency transaction patterns is recommended to detect potential unauthorized access or fund transfers linked to this phishing campaign.