ethena[.]trade

Analysis of the domain ethena.trade, observed on July 24, 2026, shows a clear pattern of brand impersonation targeting the educational brand Ethena. The domain was registered through the RIPE NCC registrar and currently resolves to the IP address 185.178.208.101, which belongs to AS57724 operated by DDOS‑GUARD LTD in Russia. Infrastructure assessment indicates a single nameserver configuration and the absence of an SSL certificate, meaning the site was served over plain HTTP. The page title retrieved from the site reads "Ethena | Empower Your Child's Future with Ethena: Elevating Education for Children and Adolescents," which mirrors legitimate Ethena branding and suggests an attempt to lure parents or guardians.

The domain is listed on one security blocklist, specifically PhishDestroy, and appears on a broader security blocklist with a single vendor flagging it on VirusTotal (1 of 95 vendors). Trust metrics are extremely low, with Scamadviser assigning a score of 22 out of 100 and Gridinsoft reporting 0 out of 100, reinforcing the malicious assessment. The reported scam type is a crypto scam, and the brand target is recorded as "across," indicating a broader impersonation scope beyond a single brand. The site status is offline at the time of reporting, which may be a temporary takedown or a tactic to evade detection.

Defenders should immediately block the domain and its associated IP address at network perimeters, update URL filtering and threat intelligence feeds to include ethena.trade, and monitor for any resurgence of the domain or related infrastructure. Continuous observation of the AS57724 range is advised, as the hosting provider is known to support malicious actors. Organizations using the Ethena brand should alert users to the fraudulent nature of this domain and reinforce verification of official URLs, especially when crypto‑related transactions are involved.