s5-etherfi[.]app

The domain s5-etherfi.app is an active phishing site engaged in brand impersonation targeting EtherFi, a cryptocurrency platform. It poses an elevated risk as a crypto scam, designed to deceive users into disclosing sensitive information or transferring assets under false pretenses. No drainer kit has been identified, but the site remains operational and continues to impersonate EtherFi to exploit victims.

Technical indicators confirm the domain's malicious nature. As of analysis, s5-etherfi.app is flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. The domain was registered on 2026-03-11 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 172.67.209.220, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate is issued by Let's Encrypt (E7), and the site returns an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare'. Nameservers are jeremy.ns.cloudflare.com and nena.ns.cloudflare.com, and the site uses HTTP/3 technology.

Users who interacted with s5-etherfi.app should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords on the legitimate EtherFi platform and enable two-factor authentication. Monitor accounts for unauthorized transactions and report the domain to relevant authorities, including the impersonated brand's security team, Google Safe Browsing, and platforms like PhishTank or OpenPhish to aid in takedown efforts.