etherfi-airdrop[.]com

The domain etherfi-airdrop.com is currently offline but was previously observed delivering a wallet/seed phishing campaign that impersonates the EtherFi brand. Infrastructure analysis shows the domain resolved to the IP address 188.114.97.3, which is hosted within the United States under ASN 13335 (Cloudflare, Inc.). No SSL certificate was presented during the brief capture of the site, indicating an unencrypted HTTP service. Reputation services assign a low trust rating: Scamadviser scores the domain 30 out of 100, while Gridinsoft reports a score of 0 out of 100, reflecting high confidence in malicious intent.

VirusTotal records indicate that 2 of 95 scanning engines flagged the domain, further corroborating suspicious activity. The page title returned by the server was "Etherfi," matching the targeted brand name. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—demonstrating consensus among threat intelligence feeds that the site is malicious. Registration data shows the domain was provisioned through ARIN, and it is served by a single nameserver, a configuration often seen in rapid‑deployment phishing infrastructure.

Defenders should immediately add etherfi-airdrop.com to network and endpoint blocklists, enforce DNS filtering to block the associated IP 188.114.97.3, and monitor for additional domains that resolve to the same Cloudflare edge network. Given the brand impersonation and wallet/seed phishing classification, security teams should also alert users of EtherFi to verify any unsolicited requests for private keys or seed phrases and treat any communications referencing EtherFi with heightened scrutiny. Ongoing observation of the Cloudflare IP range for new domains exhibiting similar characteristics is recommended to pre‑empt future impersonation attempts.