Ethereum

Crypto & web3 Switzerlandethereum.orgRank 124 of the most impersonated
Cert findings · 24 h
3
Cert findings · 7 days
25
13 reported or listed · 12 on phishing hosts
Registered lookalikes
596
48 listed by a source or an address list
Official domains
2
verified from Ethereum's own sites and records

Certificate findings for Ethereum

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Ethereum's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 31 findings, grouped by hostname

  1. ethereum.actor DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…5 addresses
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ethereum.actor
    First seen
    2026-11-05 01:31 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.78.156.59.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.78.156.59
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-05 00:30 UTC to 2027-02-03 00:30 UTC
    Logged 2026-11-05 01:29 UTC in Let's Encrypt Sycamore2027h1, entry 950,919,832
    SHA-256 66345132cb6cc9a30b676f8fe7ee8856c152e05db32b5aecd81c5bad294ca692
    Public key SHA-256 0f0f32a7193bb1bcd042cff0eaf169ebf53383a19b4d386accedcb873b978481
    Brand
    Ethereum
    Addresses
    5.78.156.59 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH
    5.161.47.86 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    5.161.230.87 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    46.62.237.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    195.201.128.179 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (46.62.237.138, 195.201.128.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.actor
    Registered
    2026-07-08 · Domain Science Kutatási Szolgáltató Korlátolt Felelősségű Társaság
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  2. ethereum.pass404.icu US · AS13335 · Cloudflare, Inc.2 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 7 mo ago
    DetailsHide
    Hostname
    ethereum.pass404.icu
    First seen
    2026-11-04 18:56 UTC
    First published
    2026-11-04 20:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:05 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 17:54 UTC to 2027-02-02 18:54 UTC
    Logged 2026-11-04 18:54 UTC in Google ParcelYard2027h1, entry 613,041,108
    SHA-256 27d69968045376cabb6e312545b75de26b2feb273c1014b274f2170eb6cfe7eb
    Public key SHA-256 7246de9a47baff08d2b9b3c3e5f4aaad8945b93cb67192e637acb03dac029aab
    Brand
    Ethereum
    Addresses
    104.21.91.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.96 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.21.91.34, 172.67.165.96): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    pass404.icu
    Registered
    2026-04-23 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 20:00 UTC

    Suggest a correction

  3. launchpad-ethereum.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    launchpad-ethereum.org
    First seen
    2026-11-04 13:11 UTC
    First published
    2026-11-04 13:59 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 12:08 UTC to 2027-02-02 13:07 UTC
    Logged 2026-11-04 13:08 UTC in Google ParcelYard2027h1, entry 608,801,224
    SHA-256 4fb03c728d6f511de55d07cd32190a7ff5c7145b953f850bf5ce88830d44f98a
    Public key SHA-256 00b873a397f233f75656074ef111b084df1418c845ed046ddcaa5c34f82ae960
    Brand
    Ethereum
    Addresses
    104.21.22.77 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.203.116 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:164d
    2606:4700:3032::ac43:cb74
    Cloudflare
    Cloudflare (104.21.22.77, 172.67.203.116): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    launchpad-ethereum.org
    Registered
    2026-07-09 · GKG.NET, INC.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:31 UTC

    Suggest a correction

  4. ethereum-casino.dk DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Listed by MetaMaskMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ethereum-casino.dk
    First seen
    2026-11-04 09:05 UTC
    First published
    2026-11-04 09:19 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:38 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 08:03 UTC to 2027-02-02 08:03 UTC
    Logged 2026-11-04 09:02 UTC in Geomys Tuscolo2027h1, entry 471,004,605
    SHA-256 23206cc063d795531e3edabd158386ec8431e7321c07504933820f28971c5912
    Public key SHA-256 cf06553fdc4647db8cd279fb5fb3d3e03a5267264c0d6d69da535de4d071adda
    Brand
    Ethereum
    Addresses
    185.53.179.149 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.149): a parking service. It answers for names that are typically for sale or unused.
    Domain
    ethereum-casino.dk
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:10 UTC

    Suggest a correction

  5. ethereum-ca.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    ethereum-ca.com
    First seen
    2026-11-04 03:05 UTC
    First published
    2026-11-04 04:15 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 02:02 UTC to 2027-02-02 02:02 UTC
    Logged 2026-11-04 03:01 UTC in Let's Encrypt Sycamore2027h1, entry 933,422,174
    SHA-256 33009a08d37857c58021d951b72eb4d82cba1c3bca90a9b4d519e93d28ed5a3b
    Public key SHA-256 355769c76c04c0b15c9fd494fba007437a00bc1c8ae67d6c2d5e3002a4e7d22a
    Brand
    Ethereum
    Addresses
    104.21.78.211 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.134 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:8986
    2606:4700:3037::6815:4ed3
    Cloudflare
    Cloudflare (104.21.78.211, 172.67.137.134): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereum-ca.com
    Registered
    2026-03-12 · Hello Internet Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:12 UTC

    Suggest a correction

  6. www.ethereum-qr-code-generator.to UA · AS6698 · virtualsystems Virtual Syst…
    ReportedPhishing hostUnder ethereum-qr-code-generator.to, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 17 mo ago
    DetailsHide
    Hostname
    www.ethereum-qr-code-generator.to
    First seen
    2026-11-04 02:26 UTC
    First published
    2026-11-04 03:04 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Reported
    PhishDestroy, listing ethereum-qr-code-generator.to and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 213.111.150.143.
    1. Phishing-host list fetched with the address
    2. Resolved to 213.111.150.143
    3. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 01:24 UTC to 2027-02-02 01:24 UTC
    Logged 2026-11-04 02:22 UTC in IPng Networks Halloumi2027h1, entry 355,868,731
    SHA-256 25c04ce8e2a5b1aff71d2054de9f0d0e819c3a6e0b32734f90fa3be703736755
    Public key SHA-256 5f9f01e4e1ef64b859c2191f2f27f737e492fda41c80eae742533b3924f31d7c
    PhishDestroy
    Brand
    Ethereum
    Addresses
    213.111.150.143 · Ukraine · AS6698 virtualsystems Virtual Systems LLC
    Domain
    ethereum-qr-code-generator.to
    Registered
    2025-06-26 · Tonic
    MX
    Receives mail at mail.ethereum-qr-code-generator.to
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  7. ethereum-qr-code-generator.to UA · AS6698 · virtualsystems Virtual Syst…
    ReportedPhishing hostReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 17 mo ago
    DetailsHide
    Hostname
    ethereum-qr-code-generator.to
    First seen
    2026-11-04 02:26 UTC
    First published
    2026-11-04 03:04 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 213.111.150.143.
    1. Phishing-host list fetched with the address
    2. Resolved to 213.111.150.143
    3. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 01:24 UTC to 2027-02-02 01:24 UTC
    Logged 2026-11-04 02:22 UTC in IPng Networks Halloumi2027h1, entry 355,868,731
    SHA-256 25c04ce8e2a5b1aff71d2054de9f0d0e819c3a6e0b32734f90fa3be703736755
    Public key SHA-256 5f9f01e4e1ef64b859c2191f2f27f737e492fda41c80eae742533b3924f31d7c
    PhishDestroy
    Brand
    Ethereum
    Addresses
    213.111.150.143 · Ukraine · AS6698 virtualsystems Virtual Systems LLC
    Domain
    ethereum-qr-code-generator.to
    Registered
    2025-06-26 · Tonic
    MX
    Receives mail at mail.ethereum-qr-code-generator.to
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  8. ethereum.vc US · AS31898 · Oracle Corporation
    Phishing hostOracle CloudAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 13 y ago
    DetailsHide
    Hostname
    ethereum.vc
    First seen
    2026-11-03 10:36 UTC
    First published
    2026-11-03 11:04 UTC
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 129.213.114.242.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 129.213.114.242
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 09:34 UTC to 2027-02-01 10:32 UTC
    Logged 2026-11-03 10:34 UTC in Google PlumbersArms2027h1, entry 588,959,308
    SHA-256 ed00f65282cba7404d317ba5bca295ae4dcf89a68e81e7bf0af279a5fec5a3e2
    Public key SHA-256 d4de47b7d60c9863cddda13fa16f2665d12b21032b77e569df8a1985d480d062
    Brand
    Ethereum
    Addresses
    129.213.114.242 · United States · AS31898 ORACLE-BMC-31898 - Oracle Corporation · Oracle Cloud (cloud provider)
    Oracle Cloud
    Oracle Cloud (129.213.114.242): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.vc
    Registered
    2014-05-07 · Name.com, Inc.
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  9. www.ethereum-casino-vergleich.de CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.ethereum-casino-vergleich.de
    First seen
    2026-11-03 08:01 UTC
    First published
    2026-11-03 08:50 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 06:59 UTC to 2027-02-01 06:59 UTC
    Logged 2026-11-03 07:58 UTC in Google ParcelYard2027h1, entry 586,293,444
    SHA-256 28ba50181999d9002246637778fe0f57655bcc38c52f22f82a36dbc1ac56f2fe
    Public key SHA-256 85ef8984c35ca9bad910369324dce9dc952241d56bd7fa4dac1ea395e4a20925
    Brand
    Ethereum
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ethereum-casino-vergleich.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  10. ethereum-casino-vergleich.de CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ethereum-casino-vergleich.de
    First seen
    2026-11-03 08:01 UTC
    First published
    2026-11-03 08:50 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 2.57.91.91.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 2.57.91.91
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 06:59 UTC to 2027-02-01 06:59 UTC
    Logged 2026-11-03 07:58 UTC in Google ParcelYard2027h1, entry 586,293,444
    SHA-256 28ba50181999d9002246637778fe0f57655bcc38c52f22f82a36dbc1ac56f2fe
    Public key SHA-256 85ef8984c35ca9bad910369324dce9dc952241d56bd7fa4dac1ea395e4a20925
    Brand
    Ethereum
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ethereum-casino-vergleich.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  11. www.ethereum-to-usdt.com UA · AS6698 · virtualsystems Virtual Syst…
    ReportedPhishing hostUnder ethereum-to-usdt.com, reported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    www.ethereum-to-usdt.com
    First seen
    2026-11-03 02:26 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Reported
    PhishDestroy, listing ethereum-to-usdt.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 213.111.150.143.
    1. Phishing-host list fetched with the address
    2. Resolved to 213.111.150.143
    3. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 01:24 UTC to 2027-02-01 01:24 UTC
    Logged 2026-11-03 02:22 UTC in IPng Networks Gouda2027h1, entry 298,327,665
    SHA-256 61dfcfe90d9df228c81439a3109949ea4bda409abcdc6191324f600c5d00949b
    Public key SHA-256 b0ad57e00ca60dcc0d3f004b7781457fa297aa07b52c2d7a2bcb30c98a7d047b
    PhishDestroy
    Brand
    Ethereum
    Addresses
    213.111.150.143 · Ukraine · AS6698 virtualsystems Virtual Systems LLC
    Domain
    ethereum-to-usdt.com
    Registered
    2025-08-08 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Receives mail at mail.ethereum-to-usdt.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  12. ethereum-to-usdt.com UA · AS6698 · virtualsystems Virtual Syst…
    ReportedPhishing hostReported by PhishDestroy · Address hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    ethereum-to-usdt.com
    First seen
    2026-11-03 02:26 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 213.111.150.143.
    1. Phishing-host list fetched with the address
    2. Resolved to 213.111.150.143
    3. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 01:24 UTC to 2027-02-01 01:24 UTC
    Logged 2026-11-03 02:22 UTC in IPng Networks Gouda2027h1, entry 298,327,665
    SHA-256 61dfcfe90d9df228c81439a3109949ea4bda409abcdc6191324f600c5d00949b
    Public key SHA-256 b0ad57e00ca60dcc0d3f004b7781457fa297aa07b52c2d7a2bcb30c98a7d047b
    PhishDestroy
    Brand
    Ethereum
    Addresses
    213.111.150.143 · Ukraine · AS6698 virtualsystems Virtual Systems LLC
    Domain
    ethereum-to-usdt.com
    Registered
    2025-08-08 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Receives mail at mail.ethereum-to-usdt.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  13. ethereumwallet.finance US · AS13335 · Cloudflare, Inc.
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 12 mo ago
    DetailsHide
    Hostname
    ethereumwallet.finance
    First seen
    2026-11-03 01:46 UTC
    First published
    2026-11-03 02:31 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:45 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR1 · precertificate
    Valid 2026-11-03 00:43 UTC to 2027-02-01 01:41 UTC
    Logged 2026-11-03 01:43 UTC in DigiCert Sphinx2027h1, entry 338,086,823
    SHA-256 3a68f7cb15bf9190ce53047f8969dca112cd34ab339f9c93b125f7c41233d565
    Public key SHA-256 45576755412e472fcd5d14df4732ca697e8d98a93a0c4bce8c80e17fec943fc4
    PhishDestroy
    Brand
    Ethereum
    Addresses
    185.158.133.1 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (185.158.133.1): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereumwallet.finance
    Registered
    2025-11-12 · Name.com, Inc.
    MX
    Receives mail at mx1.titan.email, mx2.titan.email
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  14. play.ethereum-casino-online-au.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareUnder ethereum-casino-online-au.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 mo ago
    DetailsHide
    Hostname
    play.ethereum-casino-online-au.com
    First seen
    2026-10-31 23:05 UTC
    First published
    2026-10-31 23:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:58 UTC
    Listed
    MetaMask, listing ethereum-casino-online-au.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-31 22:05 UTC to 2027-01-29 22:05 UTC
    Logged 2026-10-31 23:04 UTC in Let's Encrypt Willow2027h1, entry 871,217,646
    SHA-256 52712cc58f68d1e3328d7bae94a81bf53625ffd06bda89d0bb04374087aba0ac
    Public key SHA-256 7d3f700d61c684614cf3563ed5e1f40c063be4255e72d443c4376f71b1511e7b
    Brand
    Ethereum
    Addresses
    104.21.88.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.185.93 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:5895
    2606:4700:3036::ac43:b95d
    Cloudflare
    Cloudflare (104.21.88.149, 172.67.185.93): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereum-casino-online-au.com
    Registered
    2026-05-29 · URL Solutions, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  15. www.ethereum-mixer.org US · AS394456 · Epik LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    www.ethereum-mixer.org
    First seen
    2026-10-31 05:52 UTC
    First published
    2026-10-31 06:08 UTC
    DNS
    Resolves · checked 2026-11-05 06:11 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 209.196.146.115.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 209.196.146.115
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-31 04:52 UTC to 2027-01-29 04:52 UTC
    Logged 2026-10-31 05:50 UTC in IPng Networks Halloumi2027h1, entry 318,810,506
    SHA-256 60cd0d9dad7c6b12e6ae8ee2120dd96dcae676b2e8aeef1d92b2831a0cfd94bb
    Public key SHA-256 fbcf74dcaf2c71d3b5b4c946e2c8198b0d89c4a76dfefad51f976ffdea8afde5
    Brand
    Ethereum
    Addresses
    209.196.146.115 · United States · AS394456 EPIK-LLC - Epik LLC
    Domain
    ethereum-mixer.org
    Registered
    2025-10-06 · Epik LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  16. ethereum-mixer.org US · AS394456 · Epik LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    ethereum-mixer.org
    First seen
    2026-10-31 05:52 UTC
    First published
    2026-10-31 06:08 UTC
    DNS
    Resolves · checked 2026-11-05 06:11 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 209.196.146.115.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 209.196.146.115
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-31 04:52 UTC to 2027-01-29 04:52 UTC
    Logged 2026-10-31 05:50 UTC in IPng Networks Halloumi2027h1, entry 318,810,506
    SHA-256 60cd0d9dad7c6b12e6ae8ee2120dd96dcae676b2e8aeef1d92b2831a0cfd94bb
    Public key SHA-256 fbcf74dcaf2c71d3b5b4c946e2c8198b0d89c4a76dfefad51f976ffdea8afde5
    Brand
    Ethereum
    Addresses
    209.196.146.115 · United States · AS394456 EPIK-LLC - Epik LLC
    Domain
    ethereum-mixer.org
    Registered
    2025-10-06 · Epik LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  17. ethereumdefi.org US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    ethereumdefi.org
    First seen
    2026-10-31 05:00 UTC
    First published
    2026-10-31 05:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:18 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-31 04:00 UTC to 2027-01-29 04:00 UTC
    Logged 2026-10-31 04:59 UTC in Google ParcelYard2027h1, entry 533,798,794
    SHA-256 9359685a890916d9432847444e9a1f3b1b0e0bd39dac210c99f03b2dd5be2567
    Public key SHA-256 6e202802a37f84b4ad63ebafe906c45fb07afc03e8eb7804c11ddfbac0ca325c
    PhishDestroy
    Brand
    Ethereum
    Addresses
    104.21.52.41 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.195.16 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:3429
    2606:4700:3034::ac43:c310
    Cloudflare
    Cloudflare (104.21.52.41, 172.67.195.16): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereumdefi.org
    Registered
    2026-03-09 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  18. www.ethereumwallet.ca CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    www.ethereumwallet.ca
    First seen
    2026-10-31 02:06 UTC
    First published
    2026-10-31 02:53 UTC
    DNS
    Resolves · checked 2026-11-05 02:57 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 187.124.243.128.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 187.124.243.128
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2
    Valid 2026-10-31 00:00 UTC to 2027-01-29 23:59 UTC
    Logged 2026-10-31 02:00 UTC in Let's Encrypt Sycamore2027h1, entry 864,656,937
    SHA-256 9b835ec01bb63a1adead180beac5a4622e484c6bdd3bd5289edace252522ddcd
    Public key SHA-256 11db0eb629555eb0803540a43aec9bc558a8718ded079fcd0fc606919b44c752
    Brand
    Ethereum
    Addresses
    187.124.243.128 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (187.124.243.128): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ethereumwallet.ca
    Registered
    2022-04-20 · Go Daddy Domains Canada, Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  19. ethereumwallet.ca CY · AS47583 · AS-HOSTINGER Hostinger Inte…
    Phishing hostHostingerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    ethereumwallet.ca
    First seen
    2026-10-30 23:09 UTC
    First published
    2026-10-30 23:53 UTC
    DNS
    Resolves · checked 2026-11-04 23:58 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 187.124.243.128.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 187.124.243.128
    4. Latest DNS check
    Certificate
    Issued by ZeroSSL ECC DV SSL CA 2 · precertificate
    Valid 2026-10-30 00:00 UTC to 2027-01-28 23:59 UTC
    Logged 2026-10-30 23:01 UTC in DigiCert Wyvern2027h1, entry 363,468,431
    SHA-256 d5dfd6fcc96f8b98f855dc7c425b03250e863fde659bbfe378828607404616d7
    Public key SHA-256 d4f60d7a19a6816c1ff44ac521d8eec6d9763344a7257399bdca865e2f7117f4
    Brand
    Ethereum
    Addresses
    187.124.243.128 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (187.124.243.128): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    ethereumwallet.ca
    Registered
    2022-04-20 · Go Daddy Domains Canada, Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  20. ethereum-pulse.live US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    ethereum-pulse.live
    First seen
    2026-10-30 08:26 UTC
    First published
    2026-10-30 08:40 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:49 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 07:25 UTC to 2027-01-28 08:23 UTC
    Logged 2026-10-30 08:25 UTC in Google PlumbersArms2027h1, entry 520,186,139
    SHA-256 01df5be5be8760f5b24009e76ac85e1ca7b62e924ba1fc1216879ce43a558427
    Public key SHA-256 2a6cb500d72d0bb5f8251ce6b4c600f35070c611f1bd2f2aabdcdd5a8208e12c
    PhishDestroy
    Brand
    Ethereum
    Addresses
    104.21.45.40 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.104 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:2d28
    2606:4700:3037::ac43:d168
    Cloudflare
    Cloudflare (104.21.45.40, 172.67.209.104): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereum-pulse.live
    Registered
    2026-01-07 · Porkbun LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:00 UTC

    Suggest a correction

  21. ethereum-pulse.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    ethereum-pulse.com
    First seen
    2026-10-29 22:35 UTC
    First published
    2026-10-29 22:39 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 22:45 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-29 21:33 UTC to 2027-01-27 22:32 UTC
    Logged 2026-10-29 22:33 UTC in Geomys Tuscolo2027h1, entry 399,997,949
    SHA-256 6119f98b4ba8bee605161e540fc3da49afc3a10186ce1f7b2d9d3e1612091826
    Public key SHA-256 aa59cfa03e9962da656490f3e7cd8b8e4831e3babf7b706d1c5db00e93d636b6
    PhishDestroy
    Brand
    Ethereum
    Addresses
    104.21.64.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.174.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3037::6815:400d
    2606:4700:3037::ac43:ae18
    Cloudflare
    Cloudflare (104.21.64.13, 172.67.174.24): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereum-pulse.com
    Registered
    2026-01-07 · Porkbun LLC
    MX
    Receives mail at fwd1.porkbun.com, fwd2.porkbun.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  22. ethereum-shift.com US · AS396982 · Google LLC
    ReportedGoogle CloudReported by PhishDestroyMX absentSPF missingDMARC missingRegistered 10 mo ago
    DetailsHide
    Hostname
    ethereum-shift.com
    First seen
    2026-10-29 06:41 UTC
    First published
    2026-10-29 06:44 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 06:51 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WR3 · precertificate
    Valid 2026-10-29 05:36 UTC to 2027-01-27 06:30 UTC
    Logged 2026-10-29 06:36 UTC in DigiCert Sphinx2027h1, entry 303,033,664
    SHA-256 50f6383a122524866131496632b2b406d36e1551d8fc93bd25cd2a17d61f7647
    Public key SHA-256 44d12a488a3ead89e669ca6465dd24867d77d17e36d0470255cd96c6806cf455
    PhishDestroy
    Brand
    Ethereum
    Addresses
    34.111.141.225 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.111.141.225): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum-shift.com
    Registered
    2026-01-23 · Amazon Registrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  23. ethereum-au.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 8 mo ago
    DetailsHide
    Hostname
    ethereum-au.com
    First seen
    2026-10-28 03:41 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 02:39 UTC to 2027-01-26 02:39 UTC
    Logged 2026-10-28 03:38 UTC in Google ParcelYard2027h1, entry 482,103,090
    SHA-256 d7eb06074ec2c5bcd25330f9a1cadafb20ccdfafd2ceb4c86af882295219b185
    Public key SHA-256 9cdf0727661ca74fe329448356f4210f1f512fd63b1cd13e46e14336f53d75c6
    Brand
    Ethereum
    Addresses
    104.21.25.202 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.134.136 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:19ca
    2606:4700:3032::ac43:8688
    Cloudflare
    Cloudflare (104.21.25.202, 172.67.134.136): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereum-au.com
    Registered
    2026-03-01 · Hello Internet Corp
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  24. ethereum1.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX presentSPF ~allDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ethereum1.org
    First seen
    2026-10-27 05:37 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 15:16 UTC to 2027-01-27 15:16 UTC
    Logged 2026-10-29 16:15 UTC in Google PlumbersArms2027h1, entry 509,245,306
    SHA-256 20164edb2bf5528b404f2352f62b9585ecb69ebf28ea2ee72495e5267c76f05a
    Public key SHA-256 1de6e114ffe2e5803e67dd1975735aa1fd18491b5f33ba6f102c9fb3e0a406de
    Brand
    Ethereum
    Addresses
    104.21.86.11 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.213.188 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:560b
    2606:4700:3034::ac43:d5bc
    Cloudflare
    Cloudflare (104.21.86.11, 172.67.213.188): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ethereum1.org
    Registered
    2026-06-26 · NameCheap, Inc.
    MX
    Receives mail at route2.mx.cloudflare.net, route3.mx.cloudflare.net, route1.mx.cloudflare.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:34 UTC

    Suggest a correction

  25. ethereum.family DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…5 addresses
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    ethereum.family
    First seen
    2026-10-27 01:16 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.78.156.59.
    1. Phishing-host list fetched with the address
    2. Resolved to 5.78.156.59
    3. Latest DNS check
    Certificate
    Logged in DigiCert Wyvern2027h1, entry 318,827,623
    SHA-256 700fca95119014135d1734e9e2bd68e1168f17d1023dae51dcf28a702d2e609d
    Brand
    Ethereum
    Addresses
    5.78.156.59 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH
    5.161.47.86 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    5.161.230.87 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    46.62.237.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    195.201.128.179 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (46.62.237.138, 195.201.128.179): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.family
    Registered
    2026-06-28 · Domain Science Kutatási Szolgáltató Korlátolt Felelősségű Társaság
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:25 UTC

    Suggest a correction

  26. ethereum.wiki US · AS16509 · Amazon.com, Inc.
    ReportedAmazon Web ServicesReported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 9 y ago
    DetailsHide
    Hostname
    ethereum.wiki
    First seen
    2026-10-26 20:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 461,335,866
    SHA-256 dda41396b762074dc400a7fe359fa955b5a99b93429f24e57a5d8fd4b451b720
    PhishDestroy
    Brand
    Ethereum
    Addresses
    18.169.11.15 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.169.11.15): a cloud provider. It rents servers and addresses to its customers.
    Domain
    ethereum.wiki
    Registered
    2017-11-27 · 1API GmbH
    MX
    Receives mail at aspmx1.migadu.com, aspmx2.migadu.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

  27. www.ethereum.wiki
    ReportedUnder ethereum.wiki, reported by PhishDestroyMX presentSPF ~allDMARC policy noneRegistered 9 y ago
    DetailsHide
    Hostname
    www.ethereum.wiki
    First seen
    2026-10-26 20:56 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-10-28 · checked 2026-11-05 08:59 UTC
    Reported
    PhishDestroy, listing ethereum.wiki and the names under it
    1. Observed in the PhishDestroy feed
    2. We matched its certificate name
    3. Latest DNS check
    Certificate
    Logged in Google PlumbersArms2027h1, entry 461,335,866
    SHA-256 dda41396b762074dc400a7fe359fa955b5a99b93429f24e57a5d8fd4b451b720
    PhishDestroy
    Brand
    Ethereum
    Domain
    ethereum.wiki
    Registered
    2017-11-27 · 1API GmbH
    MX
    Receives mail at aspmx1.migadu.com, aspmx2.migadu.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Ethereum when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →