etherfic[.]icu

On 24 July 2026 the domain etherfic.icu was observed to be hosted on a Hostinger International Limited IPv6 address 2a02:4780:24:cd83:5dd7:203:6a13:7874 located in the Netherlands (AS47583). The site returned an HTTP 403 Forbidden response and presented no SSL certificate, indicating that encrypted connections are not available. Reputation checks show a Gridinsoft trust score of 0 / 100 and a Scamadviser score of 15 / 100, both reflecting a high likelihood of malicious activity. The domain appears on three independent security blocklists—PhishDestroy, ScamSniffer, and Enkrypt—confirming that it has been flagged by multiple anti‑phishing services.

VirusTotal analysis recorded a single positive detection out of 95 scanning engines, further corroborating the presence of malicious content. The registrar information lists RIPE NCC as the registration authority, and only a single nameserver is associated with the domain, though the specific server name is not disclosed. The brand target is identified as EtherFi, and the scam type is classified as a crypto‑related scam, suggesting that the domain is being used to impersonate the legitimate EtherFi service for fraudulent gain.

Because the site is currently offline, active exploitation cannot be confirmed at this moment, but the combination of low trust scores, blocklist listings, and the single vendor detection indicates a persistent threat. Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole configurations, and monitor for any resurgence of activity. Additional investigation of the hosting provider’s abuse contacts is recommended to request takedown, and security teams should remain vigilant for similar domains that mimic EtherFi or employ the same hosting infrastructure.