get-freeusd[.]org

Analysis of get-freeusd.org indicates a high‑confidence crypto‑scam infrastructure targeting the Ethereum brand. The domain was registered through Tucows Domains Inc. on August 30, 2025 and resolves to the Cloudflare IP address 172.67.207.215, which is located in the United States and advertised under ASN 13335 (Cloudflare, Inc.). The site is currently taken offline, but historical data show it served a page titled "Ethereum Events," directly impersonating Ethereum and aligning with the reported scam type of a crypto scam. Security reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 out of 100, and Scamadviser rates it 26 out of 100, both suggesting malicious intent.

The SSL certificate presented is labeled "WE1," a non‑standard identifier that often appears on fraudulent sites. Detection engines on VirusTotal flagged the domain in 12 of 95 scans, and the domain appears on at least one external blocklist. PhishDestroy has also listed the domain as blocked. These indicators collectively confirm that the domain was used for malicious cryptocurrency‑related activity.

Uncertainty remains regarding the exact content that was delivered before takedown, as no page capture is available, and the specific payload or credential‑harvesting mechanisms have not been disclosed. Defenders should add the fully qualified domain name and its resolved IP address to firewall and DNS filtering rules, monitor for any resurrection or reuse of the same hosting infrastructure, and watch for new domains that employ similar naming patterns or target the Ethereum brand. Ongoing threat‑intel feeds should be consulted for any reappearance of the WE1 certificate or related Cloudflare‑hosted assets, and incident response teams should be prepared to investigate any alerts that reference Ethereum‑related event pages originating from newly observed domains.