ethpeak[.]io

Analysis of ethpeak.io shows an active infrastructure that impersonates the Ethereum brand. The domain was registered on 27 November 2025 through Dynadot LLC and resolves to the Cloudflare IP 104.21.14.175 (AS13335, United States). Cloudflare services are confirmed by the nameservers daniella.ns.cloudflare.com and reese.ns.cloudflare.com, and the site delivers HTTP/3 traffic over a Google Trust Services / WE1 SSL certificate. An HTTP 521 response indicates the origin server is unavailable, a pattern often observed in scam sites hosted behind Cloudflare. The page title “ETH Rewards Platform — Ethereum Rewards for Holders” and the classified scam type “Crypto Scam” reveal a direct attempt to lure Ethereum holders with false reward promises. Reputation services assign a trust score of 1/100 on both Scamadviser and Gridinsoft, and the domain appears on the PhishDestroy and ScamSniffer blocklists. VirusTotal reports 11 of 95 security vendors flagging the domain, reinforcing the malicious assessment. The specific mechanisms used to collect credentials or funds have not been publicly observed, as the site’s full content beyond the title has not been analysed. Defenders should add ethpeak.io to DNS and URL filtering rules, monitor outbound connections to the underlying Cloudflare IP for anomalous traffic, and educate users that any unsolicited reward scheme claiming to distribute Ethereum rewards is likely fraudulent. Continuous monitoring of the domain’s status and periodic re‑scans are advised while the site remains active.