ethereum[.]cfd

The domain ethereum.cfd, registered on March 23, 2026 through Dynadot LLC, is currently active and serves a page titled “Ethereum.org: The complete guide to Ethereum”. The site employs an HTTP 307 redirect and presents a visual layout that mimics the official Ethereum brand, satisfying the criteria for a confirmed brand impersonation campaign. Infrastructure analysis shows the domain resolves to IP 54.215.31.113, an Amazon Web Services EC2 instance located in the US (us‑west‑1). Authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net. The web server stack includes Node.js, React, Next.js, and Netlify components, with Cloudflare handling TLS termination and providing HSTS and Browser Insights. The SSL certificate is issued by Let’s Encrypt (YR1). Threat intelligence indicates the site is listed on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scans report 2 of 95 security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. While the visible page title and infrastructure are documented, the exact payload delivered to victims—such as credential‑harvesting forms or malicious redirects—has not been captured in public samples. Consequently, the full extent of user impact, including potential data exfiltration paths, remains uncertain. Defenders should add ethereum.cfd to deny‑list filters at network perimeter and endpoint security solutions, monitor DNS queries for the domain and its authoritative nameservers, and enforce TLS inspection to capture any credential submissions. Continuous re‑evaluation of the domain’s status is advised, as additional infrastructure or related domains may appear as the campaign evolves.