etheretf.pages.dev — Ethereum ETF Brand Impersonation Phishing

This domain, etheretf.pages.dev, is under investigation for brand impersonation targeting Ethereum, a well-known cryptocurrency platform. Registered on April 27, 2026, through Cloudflare, Inc., the domain remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 172.66.46.218 and employs SSL certification issued by Google Trust Services. The page title, 'Ethereum ETF - The only token rewarding holders as Ethereum ETFs are approved,' explicitly references Ethereum and promotes a token-related incentive, a common tactic in cryptocurrency scams designed to exploit recent regulatory or market developments. Technologies detected on the domain include Chart.js, Ant Design, HSTS, and Cloudflare, indicating a structured frontend likely intended to appear legitimate. The domain is currently flagged by one security blocklist (PhishDestroy) and has received a trust score of 0/100 from Gridinsoft. No vendor detections were recorded at the time of analysis, though this absence does not confirm safety. Defenders should treat this domain as suspicious due to its alignment with Ethereum branding, the use of financial incentive language, and its recent registration. Further monitoring is recommended to assess whether additional security vendors will flag the domain or if its infrastructure evolves. Organizations should consider blocking or monitoring traffic to this domain pending additional intelligence.