ether[.]fi-v2-api-apps-connect-wallet[.]app

The domain ether.fi-v2-api-apps-connect-wallet.app is a phishing site designed to function as a crypto drainer, a type of scam that targets cryptocurrency wallets by draining funds once a victim connects their wallet. This site does not impersonate a specific legitimate brand but uses deceptive branding elements to appear trustworthy. As of the latest verification, ether.fi-v2-api-apps-connect-wallet.app has been taken offline, though it previously posed an elevated risk to users.

Technical analysis of ether.fi-v2-api-apps-connect-wallet.app reveals limited detection by security vendors, with only 1 of 95 VirusTotal vendors flagging the domain. The domain was created on February 21, 2026, and resolves to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare's infrastructure in the US. It appears on 1 security blocklist, specifically PhishDestroy, and uses an SSL certificate issued by WE1. The observed page title, 'Stake Your Assets for Higher Rewards | ether.fi,' mimics legitimate staking services to lure victims. Gridinsoft assigned the domain a trust score of 0/100, further indicating its malicious nature.

Users who may have interacted with ether.fi-v2-api-apps-connect-wallet.app should immediately revoke any token approvals granted to the site and transfer remaining funds to a new, secure wallet. To revoke approvals, use tools like Etherscan's token approval checker or similar services for other blockchains. Enable two-factor authentication on all accounts and monitor for unauthorized transactions. Report the domain to platforms such as Google Safe Browsing, PhishTank, or local cybersecurity authorities to help prevent further victimization.