etoroai[.]com

Analysis of the domain etoroai.com indicates a high-risk brand-impersonation campaign targeting users of the financial trading platform eToro. The domain was registered on December 17, 2025, through Metaregistrar BV and currently resolves to the IP address 104.21.45.204, which is part of Cloudflare's network (AS13335) located in the United States. Nameservers for the domain are hosted under Cloudflare (becky.ns.cloudflare.com and wesley.ns.cloudflare.com), a common tactic to obscure hosting infrastructure and evade takedowns. No SSL certificate was detected, increasing the risk of unencrypted credential harvesting.

The page title, 'eToro - Plateforme officielle | Trading IA 2025 | Plus de 10 000 avis,' explicitly impersonates eToro, suggesting the site was designed to deceive users into believing it is the official platform. Google Safe Browsing has flagged the domain for social engineering, and it appears on at least one security blocklist (PhishDestroy). VirusTotal reports that 14 out of 95 security vendors have flagged the domain as malicious, though the specific nature of the payload or phishing kit remains unconfirmed. Gridinsoft assigns the domain a trust score of 0/100, further corroborating its malicious classification.

As of July 23, 2026, the domain is offline, though its prior infrastructure and registration details remain relevant for defensive measures. Defenders should prioritize blocking the domain and its associated IP (104.21.45.204) in web filters, firewalls, and email security gateways. Monitoring for similar domains registered through Metaregistrar BV or utilizing Cloudflare nameservers may help identify related campaigns. Given the domain's recent creation and offline status, further analysis of historical content or redirects is not currently feasible, but the available indicators strongly suggest a fraudulent operation targeting eToro users.