# users-ethena.xyz — SUSPICIOUS

> users-ethena.xyz is a fake Ethena airdrop site pushing a drainer kit. It sports a Let's Encrypt SSL cert and was registered on 20 Mar 2026.

## Summary
PhishDestroy identifies users-ethena.xyz as an active generic phishing domain created on March 20, 2026 to impersonate Ethena’s official airdrop campaign and deploy a drainer kit that steals cryptocurrency from victim wallets.

Technical indicators show the domain resolves to IP 188.114.96.3, is registered through Dynadot LLC, and currently carries a 0/95 detection score on VirusTotal (as of seed 1f308a). The SSL certificate is issued by Let’s Encrypt, indicating recent provisioning. Public blocklist counts remain zero, and the site has not yet been flagged by Google Safe Browsing (GSB).

The domain is live and operational, hosting a convincing replica of Ethena’s airdrop portal complete with wallet-connect prompts. Immediate actions include browser-based network blocking of the domain and IP, user wallet disconnect from the site, and reporting to Ethena’s security team and Cymru’s IP abuse feed. Remaining risk is high because the drainer kit remains undetected by antivirus engines and the domain’s youth allows it to evade many reputation filters. Users should treat this domain as hostile until further evidence of remediation is provided.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-03-20 22:29:09
- Registrar: Dynadot LLC
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fa63a6f4-7536-4c2b-b534-44b70d7cf75b
- PhishDestroy: https://phishdestroy.io/domain/users-ethena.xyz/
- LLM endpoint: https://phishdestroy.io/domain/users-ethena.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/users-ethena.xyz/
Last updated: 2026-03-30