treasurypools-ethena[.]fi

The domain treasurypools-ethena.fi is an active generic phishing site posing as a staking scam, targeting cryptocurrency users with fraudulent investment opportunities. It does not impersonate a specific brand or use a known drainer kit but operates as a standalone phishing page. As of the latest verification, the site remains active, presenting an elevated risk to visitors who may be tricked into disclosing sensitive information or transferring funds.

Technical indicators confirm the suspicious nature of treasurypools-ethena.fi. The domain is flagged by 3 of 95 VirusTotal security vendors, including alphaMountain.ai, Fortinet, and Seclookup. It appears on 1 security blocklist (PhishDestroy) and resolves to the IP address 172.67.161.153, hosted on Cloudflare’s infrastructure (AS13335) in the US. The SSL certificate is issued by Google Trust Services (WE1), and the domain was created on February 21, 2026. The observed page title is '$ENA', and the site returns an HTTP 403 status. Gridinsoft assigns it a trust score of 0/100, and technologies detected include Cloudflare and HTTP/3.

Users who interacted with treasurypools-ethena.fi should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybersecurity authorities to aid in takedown efforts. Monitor financial accounts for unauthorized transactions and consider using browser extensions or security tools to block known phishing domains.