vote-etherfi[.]app

The domain vote-etherfi.app is currently active and has been identified as a phishing site conducting brand impersonation of etherfi. This domain is associated with a wallet connect phishing scam, designed to deceive users into believing they are interacting with the legitimate etherfi service. The site is not safe and poses an elevated risk to users, as it attempts to steal sensitive wallet information under the guise of the etherfi brand.

Technical analysis shows that vote-etherfi.app was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 10, 2026, and resolves to IP address 104.21.22.131, located in the US under AS13335 Cloudflare, Inc. The SSL certificate is issued by Let's Encrypt / E8. The site appears on four security blocklists, including PhishDestroy, MetaMask, SEAL, and Enkrypt. VirusTotal reports that 1 of 95 security vendors, specifically SOCRadar, detects this domain as malicious. The page title is 'Etherfi', and technologies in use include Cloudflare Browser Insights, Cloudflare, and HTTP/3. The current HTTP status is 403, and the Gridinsoft trust score is 0/100.

Users who have interacted with vote-etherfi.app, especially via wallet connect, should immediately revoke any token approvals granted to this domain and transfer assets to a new wallet to prevent unauthorized access. It is also advised to monitor all associated accounts for suspicious activity. Incidents should be reported to the impersonated brand etherfi and relevant security authorities to help prevent further harm from this phishing scam.