etherfn[.]icu

The domain etherfn.icu is a brand impersonation threat specifically targeting Allbridge, a cross-chain bridging solution. The domain is currently offline, but its infrastructure and indicators confirm it was designed to deceive users into connecting wallets or authorizing transactions, likely leading to asset theft. The page title claimed to revolutionize trading with Fluedrops, Allbridge, and DEX integration, a clear attempt to lure cryptocurrency users.

Technical analysis reveals that etherfn.icu is flagged by 5 of 95 VirusTotal security vendors, indicating moderate detection across the threat intelligence community. The domain resolves to the IPv6 address 2606:4700:3031::6815:5105, associated with Cloudflare infrastructure, and was registered through ARIN. The domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. ScamAdviser assigns a trust score of 1 out of 100, reflecting high risk and minimal legitimacy. No creation date is provided in the known intelligence, but the combination of low trust score, blocklist presence, and impersonation of a well-known DeFi brand strongly supports a malicious classification.

As etherfn.icu is currently offline, the immediate risk of active exploitation is reduced, but the domain could be reactivated or repurposed. Users should avoid any interaction with this domain or similar URLs. Recommendations include monitoring for related domains through threat intelligence feeds, blocking the IP address 2606:4700:3031::6815:5105 at the network level, and educating users about verifying official Allbridge channels before connecting wallets or signing transactions. Regular checks of blocklist updates and VirusTotal reports are advised to track any resurgence.