app-efhen[.]li

The domain app-efhen.li is currently listed as offline but continues to be flagged for high‑risk brand impersonation targeting Coinbase. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL certificate is presented for the host, indicating that HTTPS is not configured or the certificate has been removed, which is consistent with the offline status. The site’s HTTP response, when captured, displayed the page title "Portfolio | etherfi," a title that does not reference Coinbase and suggests that the landing page content has been altered or is no longer serving the intended phishing payload.

Detection infrastructure shows that PhishDestroy and ScamSniffer have added the domain to their blocklists, and two additional security blocklists also contain the host. Google Safe Browsing classifies the domain as a social engineering threat, reinforcing the phishing assessment. VirusTotal reports that 13 out of 95 security vendors have flagged the domain, providing independent corroboration of malicious intent. The Gridinsoft trust score is recorded as 0 out of 100, indicating a complete lack of trust.

While the available evidence confirms the domain’s association with a wallet/seed phishing kit targeting Coinbase users, the offline status prevents direct observation of the payload, login forms, or malicious URLs that might have been hosted previously. Consequently, the precise phishing flow and any embedded malicious binaries remain uncertain. Defenders should immediately block traffic to app-efhen.li at perimeter and endpoint layers, add the IP 188.114.97.3 to deny lists, and monitor for any resurgence of activity that may indicate the domain being reactivated.