ethi[.]top

This domain, ethi.top, is flagged as a Web3 wallet phishing site targeting cryptocurrency users through deceptive reward portal branding. Analysis of the page title, 'REWARD Portal v2 | Latest Web3 Wallet,' indicates an attempt to mimic legitimate wallet or airdrop platforms, likely deploying a crypto drainer kit to siphon digital assets from unsuspecting victims. The infrastructure is designed to exploit trust in decentralized finance (DeFi) ecosystems, a common tactic in recent phishing campaigns observed in Q1 2024. Technical indicators reveal multiple high-risk attributes. The domain resolves to IP address 172.67.149.137 and was registered through NiceNIC International Group Co., Limited on February 21, 2026. VirusTotal detection metrics show 4 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on five distinct security blocklists, including MetaMask and ScamSniffer, and is categorized under generic_phishing. SSL certification is provided by Google Trust Services, and the site employs Cloudflare infrastructure with HSTS and HTTP/3 protocols, which may obscure malicious activity behind legitimate security measures. As of the latest assessment, ethi.top has been taken offline, reducing immediate exposure risk. However, the domain's registration remains active, and similar infrastructure may resurface under different aliases. Users are advised to verify wallet interactions through official channels only and to monitor for unauthorized transactions. Security teams should maintain blocklist updates and conduct retrospective analysis on related IPs or registrars to mitigate recurring threats from this actor.