enacrypto[.]xyz

enacrypto.xyz is currently classified as a high‑risk brand‑impersonation site targeting users with an Airdrop‑related cryptocurrency scam. The page hosted at the domain displays the title “Urgent: Claim Your Ethena Now in the Enaairdrop!” and mimics legitimate communications to lure victims into claiming non‑existent tokens. The site is active as of 12 July 2026 and was registered on 21 February 2026 through the registrar REGRU‑RU. It resolves to the IP address 104.21.32.1, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. DNS resolution is provided by doug.ns.cloudflare.com and oaklyn.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS connection. Network and application fingerprints reveal the use of multiple cloud and email services. Detected technologies include Apple iCloud Mail, Envoy, Amazon Web Services, Tengine, Zendesk, Sendgrid, HTTP Strict Transport Security (HSTS), and Amazon S3 storage. These components suggest the actors are leveraging reputable infrastructure to host phishing pages and to manage communications with potential victims. The domain appears on two security blocklists and has been flagged by PhishDestroy and ScamSniffer. VirusTotal scans show that 6 out of 95 security vendors flagged the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The phishing kit identified is the “Airdrop Scam” kit, which is commonly used to impersonate cryptocurrency airdrop offers. Defenders should block enacrypto.xyz at perimeter filters and DNS resolvers, monitor outbound connections to the associated IP address, and enforce strict email authentication to reduce successful luring attempts. Continuous threat‑intel feeds should be consulted for any updates to the underlying infrastructure, and incident response teams should be prepared to investigate any reports of credential or cryptocurrency loss linked to this domain.