ethena-liqulfi[.]xyz

The domain ethena-liqulfi.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare‑owned address 188.114.96.3 (AS13335, United States). The authoritative name servers dante.ns.cloudflare.com and elisa.ns.cloudflare.com confirm that the domain leveraged Cloudflare’s DNS infrastructure. No TLS certificate was presented, indicating that the site operated over plain HTTP. When accessed, the sole visible element was the page title “Liquifi Airdrops”, which aligns with the reported phishing kit classified as an “Airdrop Scam” and the broader crypto‑scam category.

VirusTotal scanned the host and recorded six positive detections out of ninety‑three submitted scanners, reinforcing the malicious assessment. Independent threat‑intelligence feeds have listed the domain on at least one security blocklist and the anti‑phishing service PhishDestroy has already taken the site offline. The current HTTP status is reported as offline, confirming that active content is no longer reachable. Analysis of the available telemetry suggests a short‑lived campaign targeting cryptocurrency investors by promising unauthorized “airdrop” rewards.

The use of Cloudflare’s network provides the attacker with rapid provisioning and basic anonymity, while the lack of encryption may be an operational oversight or a tactic to avoid TLS inspection. Defenders should add the domain and its resolving IP address to network‑level deny lists, enforce DNS filtering for the associated Cloudflare name servers, and monitor for other domains that resolve to the same IP or share the “Airdrop Scam” kit fingerprint. Continuous review of VirusTotal and blocklist feeds is recommended to capture any re‑registration attempts. Because the site is already offline, immediate mitigation focuses on preventing reuse of the infrastructure and alerting users about the “Liquifi Airdrops” lure.