ethena[.]co[.]com

The domain ethena.co.com was observed as part of a brand‑impersonation campaign targeting the foundation brand. The site is currently offline, having been taken down after being blocked by the PhishDestroy sinkhole. No SSL certificate was presented during the brief observation period, indicating the service was reachable only over plain HTTP. Infrastructure analysis shows the domain resolves to the Cloudflare address 172.67.176.125, associated with AS13335 (Cloudflare, Inc.) and hosted in the United States.

Nameserver configuration uses khloe.ns.cloudflare.com and ridge.ns.cloudflare.com, confirming Cloudflare as the DNS provider. The page title returned was "Ethena Mind - Game Mechanics Programming & IT Education Platform," which does not reference the foundation brand, suggesting the content may have been unrelated or dynamically generated. Threat intelligence indicates the domain appears on a single security blocklist and was flagged by one of ninety‑five VirusTotal scanners, reflecting limited detection coverage. Reputation services assign a Scamadviser trust score of 45 / 100 and a Gridinsoft score of 0 / 100, both indicating low credibility.

The classification as a crypto scam aligns with the observed impersonation of the foundation brand, although the exact mechanisms employed (e.g., credential harvesting, wallet address substitution) have not been disclosed. Given the domain’s association with a known blocklist, its Cloudflare hosting, and the lack of TLS protection, defenders should continue to block ethena.co.com at perimeter and DNS layers, monitor for any re‑registration attempts, and incorporate the observed indicators—including the IP address, nameservers, and trust scores—into threat‑intel feeds. Ongoing surveillance is recommended to capture any resurgence or repurposing of the infrastructure, as the current evidence is limited to the listed attributes.