ethereumplus[.]org

Analysis of ethereumplus.org indicates an active brand-impersonation campaign targeting Ethereum users. The domain was registered on August 24, 2022 through Internet Domain Service BS Corp and resolves to the IP address 198.18.2.115, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site is served over HTTPS using a Google Trust Services / WE1 certificate and returns HTTP 200 responses. Technical fingerprints reveal the use of Bootstrap, OWL Carousel, jQuery, Cloudflare services, and HTTP/3. Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, Scamadviser rates the site at 46/100, and four of ninety‑five VirusTotal scanners flag the domain. It appears on one external blocklist and is listed by PhishDestroy as malicious. The page title "Ethereum Sports Betting - Bet Online with ETH" and the stated impersonation of Ethereum suggest a crypto‑related gambling scam, corroborated by the identification of a Gambler Scam phishing kit. While the infrastructure details are concrete, the exact content of the landing page has not been examined, leaving the specific user‑interaction flow uncertain. Defenders should block the domain at network perimeter, monitor DNS queries for the domain and its associated IP, and advise users to avoid any unsolicited offers to bet with Ethereum. Continuous re‑evaluation is recommended as threat actors may modify the site or deploy additional infrastructure.