season7-ethena[.]xyz

Analysis of the domain season7-ethena.xyz indicates it is an active phishing infrastructure targeting users of the Ethena platform, as suggested by the domain naming convention. As of August 06, 2026, the domain resolves to IP address 104.21.9.104, which is associated with Cloudflare's network, a common hosting choice for phishing sites due to its proxy services. Detection data from VirusTotal shows that 3 out of 91 security vendors have flagged this domain as malicious, providing preliminary evidence of its harmful intent.

The domain also appears on one security blocklist, further corroborating its classification as a threat. No additional details regarding the registrar, registration date, or SSL certificate are provided in the available intelligence. The exact content of the site remains unanalyzed, though the domain structure suggests an attempt to impersonate Ethena-related rewards or promotional pages.

Defenders should treat this domain as an elevated-risk phishing resource and consider blocking it at the network level. Monitoring for related domains using similar naming patterns (e.g., 'seasonX-ethena') may help identify additional threats. Given the limited detection coverage, organizations should not rely solely on vendor signatures and should verify the domain against internal threat feeds or sandboxing tools for further validation.