ethena-fi[.]club

This domain is flagged as a confirmed cryptocurrency phishing site with an elevated risk level. Analysis indicates it specifically targets users by impersonating the legitimate Ethena platform, likely to harvest wallet credentials, seed phrases, or private keys through fraudulent interfaces. The threat type is classified as generic_phishing with a focus on cryptocurrency-related credential theft, a common vector for financial fraud and unauthorized asset transfers. Infrastructure analysis reveals the following technical indicators: the domain ethena-fi.club is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.96.3. It was created on April 23, 2026, though this date may reflect registry manipulation or a typographical error, as it predates the current year. The domain appears on three security blocklists and is blocked by MetaMask, PhishDestroy, and SEAL. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0 out of 100. The page title, 'Overview | Ethena,' further confirms its intent to deceive users by mimicking the legitimate Ethena platform. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (188.114.96.3) at the network level. Organizations should update endpoint protection rules to detect and prevent access to this domain, particularly in environments where cryptocurrency transactions occur. Users who may have interacted with the site should revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Security teams are advised to review logs for connections to 188.114.96.3 or DNS queries for ethena-fi.club, as these may indicate compromise. Given the domain's offline status, further monitoring for re-registration or similar impersonation domains is recommended.