ethena[.]io

This domain, ethena.io, is under active investigation for brand impersonation targeting GoDaddy, classified as a crypto scam. As of July 12, 2026, the domain remains operational and is hosted on Amazon's infrastructure (AS16509) in the US, resolving to IP 15.197.148.33. Infrastructure analysis reveals Cloudflare protection and HTTP/3 usage, with a single nameserver configuration, which is atypical for legitimate service providers but common in phishing setups to evade detection. The domain currently returns a 301 HTTP status, redirecting visitors, though the destination is not confirmed. The page title, 'angelcitywoodshop.com | 522: Connection timed out,' suggests either a misconfigured or intentionally obfuscated endpoint, possibly to avoid scrutiny or delay analysis. The domain is registered through ARIN and has been flagged by at least one security blocklist, with a trust score of 0/100. While no detections were reported by the 95 vendors that scanned it, this absence does not confirm safety, as phishing domains often evade initial detection through rapid rotation or obfuscation techniques. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the risk, as legitimate certificates are frequently abused in phishing campaigns. Defenders should treat this domain as high-risk due to its association with known phishing tactics, brand impersonation, and crypto scam classification. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to the resolving IP (15.197.148.33), and investigating any internal systems that may have interacted with it. If this domain is encountered in logs or alerts, correlate with other indicators such as the ASN (16509) and SSL certificate issuer to identify related infrastructure. Further analysis is required to determine the full scope of the campaign, including any redirection chains or associated malware.