Social-media impersonation scam spike

Evidence summary #

Multiple fake ether.fi domains documented active as of Nov 2025 (claim-ether[.]fi, ethar[.]fi, etc.) running ETHFI giveaway scams that drain wallets. Persistent impersonation ecosystem active across X/Twitter, fake domains, and phishing overlays. This is a persistent low-level condition rather than an acute spike but warrants yellow given breadth of documented fake infrastructure.

Sources #

Methodology #

Detect a sharp uptick in Discord/Telegram/X accounts impersonating the protocol team or announcing fake airdrops.

See the full factor methodology and distribution across all protocols →