etherfi-club[.]app

etherfi-club.app is a generic phishing domain that impersonates the legitimate Ether.fi platform to steal user credentials and potentially drain crypto assets. The domain is currently offline, having been taken down after security researchers flagged its malicious intent. It was created on April 15, 2026, and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolving to IP address 188.114.96.3.

According to threat intelligence data, this domain was flagged by 3 of 95 VirusTotal vendors as malicious, and it appears on three separate security blocklists. AlienVault OTX recorded it in one threat intelligence pulse, and the SSL certificate was issued by Let's Encrypt (E7), which is commonly abused by phishing sites. The page title observed was "Just a moment...", a typical Cloudflare challenge page used to obscure malicious content.

Because etherfi-club.app is now offline, the immediate risk is low, but users should remain vigilant against similar domains. PhishDestroy recommends avoiding any unsolicited links claiming to be from Ether.fi, verifying URLs carefully, and using multi-factor authentication. If you have already interacted with this domain, change your passwords and monitor your accounts for unauthorized activity.