register-etherfi[.]net

This domain, register-etherfi.net, presents a high-risk brand impersonation threat targeting EtherFi users through a fraudulent token claim portal. Analysis of the page structure and metadata reveals a near-identical replication of EtherFi’s official branding, including identical page titles and visual assets. The site is designed to harvest cryptocurrency wallet credentials and private keys, likely deploying a crypto drainer script upon user interaction. Such infrastructure is commonly used to siphon funds from connected wallets, particularly those interacting with decentralized finance protocols or token airdrops. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain was registered on March 12, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.202.236 and is protected by Cloudflare, masking its origin infrastructure. As of the latest assessment, 10 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on five distinct security blocklists. Additional detections include MetaMask, PhishDestroy, SEAL, Enkrypt, and ScamSniffer, reinforcing its classification as an active threat. The domain employs a Let’s Encrypt SSL certificate and HTTP/3, further mimicking legitimate services. Users who have visited register-etherfi.net or interacted with its content should take immediate remediation steps. Disconnect any wallets previously linked to the site and revoke all active session permissions via blockchain explorers or wallet management tools. Monitor connected accounts for unauthorized transactions and consider migrating assets to a new wallet if credentials were entered. Report the domain to relevant security communities and wallet providers to aid in broader threat mitigation. Proactive monitoring of wallet addresses for anomalous activity is strongly recommended for at least 30 days post-exposure.