ethereummergesystem-com[.]financecryptoworld[.]com

On July 29, 2026, the domain ethereummergesystem-com.financecryptoworld.com was identified as an active crypto‑drainer infrastructure. The domain was registered through MainReg Inc. on 30 January 2025 and is hosted on the IP address 172.67.74.206, which belongs to Cloudflare’s edge network. Its authoritative name servers are cora.ns.cloudflare.com and yew.ns.cloudflare.com, indicating the use of Cloudflare’s DNS services for rapid content delivery and possible obfuscation. The domain appears on three independent security blocklists, and it has been flagged by the PhishDestroy, MetaMask, and SEAL blocking solutions, confirming that multiple anti‑phishing and wallet‑security products have taken defensive action against it.

VirusTotal analysis shows that 17 of 91 scanned security vendors have raised a detection, reinforcing the malicious classification. The infrastructure suggests a deliberate attempt to lure cryptocurrency users into authorizing transactions that drain funds. The use of a sub‑domain under financecryptoworld.com, combined with the “ethereummergesystem” component, may be intended to convey legitimacy to victims familiar with Ethereum‑related services. However, no public page title or brand‑specific landing page has been disclosed, so the exact visual impersonation technique remains unknown.

The presence of the domain on blocklists and the multi‑vendor detections provide concrete evidence of its malicious intent, while the lack of a publicly available page snapshot limits the ability to attribute a specific phishing kit or victim flow. Defenders should block the domain at network perimeter and DNS resolvers, add it to endpoint and browser blocklists, and monitor outbound connections to the associated IP address for any unauthorized cryptocurrency transaction attempts. Incident response teams should also inspect wallet activity for signs of unauthorized approvals that may have originated from this infrastructure.