etherfi-vote[.]xyz

This domain, etherfi-vote.xyz, is identified as a crypto drainer scam specifically targeting users of the legitimate ether.fi platform. The threat actor impersonates ether.fi’s branding, luring victims with fraudulent promises of "Earn DeFi Rewards Effortlessly with Liquid Vaults" to trick them into connecting wallets. No specific drainer kit has been confirmed, but the domain exhibits characteristics consistent with wallet-draining attacks, including the use of crypto-js for cryptographic operations and Cloudflare infrastructure to obfuscate malicious activity. Analysis indicates the domain was registered on June 13, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 104.21.86.82, which is part of Cloudflare’s network, further complicating attribution. The domain is flagged by 6 out of 95 security vendors on VirusTotal, appears on 4 security blocklists, and is blocked by MetaMask, PhishDestroy, SEAL, and ScamSniffer. Additionally, AlienVault OTX lists it in 2 threat intelligence pulses, reinforcing its malicious classification. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate. As of the latest assessment, etherfi-vote.xyz has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential threat, as threat actors may re-deploy the domain or shift to similar variants. Users who interacted with the domain should revoke wallet permissions, monitor for unauthorized transactions, and verify the legitimacy of any connected DeFi platforms. Organizations should update blocklists to include this domain and its associated IP address to prevent future access.