ethenafinance[.]net

The domain ethenafinance.net was observed to resolve to the IPv4 address 179.43.180.36, which is allocated to Private Layer INC under ASN 51852 and geolocated to Switzerland. Registration was performed through the RIPE NCC registry, indicating that the registrant used a regional European network resource. No TLS certificate was presented for the host, meaning all HTTP traffic would be unencrypted, a common characteristic of low‑effort fraudulent infrastructure. Reputation scoring services have assigned extremely low trust values: Gridinsoft rates the domain 0 out of 100, and Scamadviser gives it 1 out of 100, both suggesting a high likelihood of malicious activity.

VirusTotal reports that 11 of 95 scanned security vendors flagged the domain, reinforcing the suspicion of abuse. Independent blocklist operators PhishDestroy and ScamSniffer have added ethenafinance.net to their denial lists, and the domain appears on two additional security blocklists, further confirming its classification as a threat vector. The listed scam type is “Crypto Scam,” implying that any content associated with the domain is intended to deceive victims into sending cryptocurrency or personal credentials. The domain’s current operational status is offline, which may indicate that the campaign has been taken down or is temporarily inactive.

However, the observable infrastructure—unsecured HTTP, low trust scores, multiple vendor detections, and inclusion on reputable blocklists—provides sufficient evidence for security teams to treat the domain as malicious. Defenders should ensure that ethenafinance.net is blocked at perimeter and endpoint controls, monitor DNS logs for any attempted resolutions, and consider adding the associated IP address 179.43.180.36 to network‑level deny lists. Continuous re‑evaluation is advised in case the domain is re‑hosted or the threat actors resurrect the campaign.