get-etherfinances[.]xyz

Analysis indicates that the domain get-etherfinances.xyz was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and is explicitly designed to impersonate EtherFi, a known liquid restaking protocol. Infrastructure analysis reveals the domain was hosted behind Cloudflare nameservers (nena.ns.cloudflare.com and rohin.ns.cloudflare.com) and resolved to the Cloudflare IP 188.114.97.3, associated with AS13335. The SSL certificate, issued by Google Trust Services (WE1), provides no additional attribution beyond confirming an encrypted connection. As of July 24, 2026, the domain is offline, though it remains present on three security blocklists, including PhishDestroy, MetaMask, and SEAL.

Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious. VirusTotal data shows three out of ninety-one security vendors flagged the domain, though the specific detection rules or payloads are not publicly disclosed. No evidence from Google Safe Browsing, Open Threat Exchange, or HTTP response analysis is available, leaving the exact content and functionality of the site unconfirmed. The combination of Cloudflare hosting, recent registration, and direct association with EtherFi’s branding strongly suggests a brand impersonation campaign targeting users of the legitimate platform.

Defenders should treat any prior resolution of this domain as a high-confidence indicator of compromise. Network security teams are advised to block the domain and IP at perimeter controls, while monitoring for related infrastructure, such as subdomains or newly registered lookalike domains. Given the domain’s current offline status, further forensic analysis may be limited, though historical DNS and WHOIS records should be preserved for potential incident response.