ethena[.]fit

Analysis as of July 22 2026 indicates that the domain ethena.fit is currently taken offline but continues to be listed on at least one security blocklist. The domain was registered on February 21 2026 and resolves to the IP address 172.67.155.136, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presents a page title “Nur einen Moment…”, and the SSL certificate is identified as WE1.

Threat intelligence classifies the activity as a crypto‑scam, and the domain is blocked by the PhishDestroy feed. A VirusTotal scan involving 93 AV engines returned no detections, yet the absence of flags does not constitute evidence of legitimacy. The combination of recent registration, use of a shared Cloudflare edge, inclusion on a blocklist, and the specific crypto‑scam labeling suggests malicious intent despite the current offline status.

Uncertainties remain regarding the exact payload or phishing kit employed, because no page content or payload hashes have been disclosed. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation attempts, and consider adding the IP address to threat intelligence feeds. Additional investigation such as sandboxing of any retrieved content, inspection of TLS handshake details, and correlation with other known crypto‑scam campaigns is advised to determine whether the infrastructure is being reused elsewhere.