etheremwllet[.]webflow[.]io

etheremwllet.webflow.io is flagged as a high‑risk brand‑impersonation site targeting the Ethereum brand. The domain, created on 08 May 2013 and registered via MarkMonitor, Inc., resolves to the Cloudflare‑owned address 172.64.151.8 (AS13335, United States). DNS resolution uses the Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint. HTTP probing returns a 404 status code; the page title observed in prior scans is “ethereum wallet | Access point to the Ethereum Wallet”, which aligns with the declared crypto‑scam classification.

Infrastructure analysis shows the site leveraged Cloudflare’s HTTP/3 protocol, suggesting modern delivery but providing limited visibility into payload content. Reputation data is uniformly negative: the domain appears on one security blocklist, received 15 detections out of 95 scanners on VirusTotal, and is listed by Google Safe Browsing as a social‑engineering threat. PhishDestroy also blocks the host, and Scamadviser assigns a trust score of 1 / 100. The combined evidence supports a conclusion that the domain was used to lure users into a fraudulent Ethereum‑wallet interface, although the current offline status prevents verification of the exact user‑experience.

Defenders should immediately block the domain and its associated IP address at perimeter and endpoint layers, monitor for any residual traffic, and update threat‑intel feeds with the observed indicators. Continuous observation of the Cloudflare edge IP is advised, as the attacker could repurpose the same address for future campaigns. Until the site is definitively taken down, the high risk rating remains justified.