ethmoney[.]org

The domain ethmoney.org has been identified as a high-risk crypto drainer specifically targeting users of the DeFi-ETH platform. Analysis indicates this domain is designed to execute unauthorized transactions by draining cryptocurrency wallets through deceptive smart contract interactions. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating broad detection of malicious intent. It was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial services. The domain resolved to the IP address 188.114.97.3, a Cloudflare-hosted endpoint, and was observed on three security blocklists. Additional technical indicators include a Gridinsoft trust score of 0/100, use of HTTP/3, and an SSL certificate issued by Google Trust Services. The page title, DeFi-ETH, directly impersonates the legitimate decentralized finance platform to deceive users. Current status confirms the domain is offline, though residual risk persists for users who may have interacted with it during its active period. Organizations and individuals are advised to block the domain and associated IP at the network level, revoke any wallet permissions granted to the domain, and conduct a forensic review of systems that accessed it. Wallet addresses linked to this domain should be treated as compromised and monitored for unauthorized transactions. Users are urged to verify all decentralized application interactions through official channels and employ hardware-based transaction signing for high-value operations.