event-ethena[.]xyz

This domain, event-ethena.xyz, was registered on 14 April 2026 through Dynadot LLC and is currently pointing to the Cloudflare‑managed address 104.21.63.114. The authoritative nameservers are jerome.ns.cloudflare.com and ollie.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. An HTTPS endpoint presents a Let’s Encrypt certificate (issuer: E8) and returns an HTTP 403 status code, while the page title reported by automated crawlers is “Just a moment…”. The infrastructure is listed as active in multiple monitoring feeds and has been observed in a single AlienVault OTX pulse.

The domain is classified as a generic phishing site and carries a high risk rating. Gridinsoft assigns a trust score of 0 out of 100, and five of ninety‑five VirusTotal scanners have flagged the domain as malicious. It appears on three external blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the perception of abuse.

Evidence beyond the DNS and certificate data is limited; the content of the site has not been publicly disclosed, and no specific brand, phishing kit, or targeted service has been identified. The presence of a generic “Just a moment…” title suggests a possible interstitial or challenge page, but the lack of additional page analysis prevents confirmation of the exact phishing vector.

Defenders should add event-ethena.xyz to network and endpoint blocklists, enforce DNS sink‑holing for the associated IP range, and monitor outbound connections to Cloudflare‑served addresses for anomalous activity. Continuous re‑scanning with updated VirusTotal and threat‑intel platforms is advised, as the domain’s status may evolve. Organizations should also consider implementing email and web gateway controls that reference the known blocklists to reduce exposure.