etherfi-download[.]icu

On 25 July 2026, the domain www.etherfi-download.icu was observed as an offline site that had been used for brand impersonation targeting EtherFi. The domain was registered on 12 March 2026 through Hostinger operations, UAB and is hosted on an Amazon Web Services address (AS16509, Amazon.com, Inc.) with the A record 64.29.17.65 located in the United States. DNS resolution is served by Vercel's authoritative name servers ns1.vercel-dns.com and ns2.vercel-dns.com, and the site presented a valid Let’s Encrypt certificate (R13) and HSTS header, indicating use of modern TLS practices. Technical fingerprinting identified the presence of Vercel hosting infrastructure and a LiveChat widget, which are common components in malicious drop‑sites.

VirusTotal analysis recorded three positive detections out of ninety‑four scanned scanners, confirming that at least a subset of security products consider the domain malicious. The site is listed on a single public blocklist, PhishDestroy, which has already taken the domain offline. The page title returned by HTTP requests is “etherfi-download.icu/”, providing no additional context about the content served. The primary threat vector appears to be a crypto‑related scam that pretends to be associated with the EtherFi brand, though the exact payload or credential‑harvesting mechanism has not been publicly disclosed.

Because the site is no longer reachable, direct observation of the landing page is not possible, leaving the specifics of the phishing flow uncertain. Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce blocklist updates that include PhishDestroy entries, and consider adding the IP 64.29.17.65 to network‑level deny lists. Additionally, organizations that interact with EtherFi services should educate users about the risk of unsolicited download prompts and verify URLs against the official EtherFi domain.