claim-etherfi[.]io

The domain claim-etherfi.io was observed as offline at the time of analysis on July 22, 2026. It was registered on September 21, 2024 through PDR Ltd. d/b/a PublicDomainRegistry.com and is hosted on Cloudflare infrastructure (AS13335) with the resolved address 104.21.48.1, a US‑based endpoint. The domain uses Cloudflare’s default nameservers mckenzie.ns.cloudflare.com and trace.ns.cloudflare.com, and no TLS certificate was detected, indicating that HTTPS was not configured. The only visible page title returned by the web server is "Nur einen Moment…," which does not provide direct evidence of the content or the phishing technique employed.

VirusTotal has processed the domain with submissions from 95 vendors, and none of those scanners reported a detection. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy. The intelligence categorizes the campaign as a crypto‑related scam that impersonates the EtherFi brand.

While the presence on a blocklist and the brand‑impersonation label suggest malicious intent, the lack of SSL, the generic page title, and the absence of public detection flags leave the precise payload and victim interaction unknown. Defenders should add claim-etherfi.io to domain‑based deny lists, monitor outbound traffic for connections to the IP 104.21.48.1, and enforce DNS filtering that includes the identified blocklist. Continuous re‑evaluation is advised, as the site may reactivate or change its hosting configuration, and further analysis of any future content should focus on confirming the phishing vector, collecting any credential‑phishing forms, and correlating with other EtherFi‑related threat indicators.