season5-etherfi[.]xyz

On 24 July 2026, security analysis identified season5-etherfi.xyz as a crypto‑related brand‑impersonation campaign targeting EtherFi. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on 11 March 2026 and is hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to 188.114.97.3 and the authoritative nameservers are dakota.ns.cloudflare.com and meadow.ns.cloudflare.com. The site served an HTTP 403 response and presented a Let’s Encrypt certificate (issuer E8), indicating the use of standard TLS termination provided by Cloudflare.

Automated scanning on VirusTotal recorded seven positive detections out of ninety‑four scanners, and the domain appears on four independent blocklists, including PhishDestroy, MetaMask, ScamSniffer and SEAL. Technical fingerprinting revealed the presence of Cloudflare services and HTTP/3 support, consistent with the infrastructure choices of many fast‑flux phishing operations. The page title returned by the server is “Suspected phishing site | Cloudflare”, confirming that the content has been flagged by Cloudflare’s takedown mechanisms. The campaign’s primary objective is classified as a crypto scam, with the adversary explicitly impersonating the EtherFi brand.

Current host status is offline, suggesting that the site has been taken down or is no longer serving content. Uncertainty remains regarding the exact content delivered to victims and the extent of user interaction before takedown. Defenders should continue to block the domain at DNS and proxy layers, monitor any future resolution changes, and add the associated IP address 188.114.97.3 to deny‑list rules. Additional monitoring of the registrar and the identified blocklists is recommended to detect potential re‑registration attempts or related infrastructure reuse.