app-ethena[.]click

This domain, app-ethena.click, is identified as a cryptocurrency phishing site targeting users of the Ethena platform. Analysis indicates it employs generic phishing tactics to harvest credentials or private keys, likely through a fake wallet interface or token claim page. The domain mimics the legitimate Ethena brand, a synthetic dollar protocol, to deceive victims into disclosing sensitive financial information or authorizing malicious transactions. Technical indicators confirm the domain's malicious nature. It resolves to IP address 172.67.213.85 and was registered on September 27, 2025, through Web Commerce Communications Limited. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on five security blocklists, including Polkadot, Codeesura, PhishDestroy, ScamSniffer, and Enkrypt. No Google Safe Browsing (GSB) detection was noted at the time of analysis, though this may reflect a lag in reporting rather than absence of threat. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. Response actions by security providers have successfully blocked access, but users who interacted with the domain prior to takedown may still be at risk. Remaining threats include potential credential reuse or unauthorized access to linked wallets. Users are advised to revoke any suspicious token approvals, monitor connected accounts for unauthorized transactions, and verify the legitimacy of any Ethena-related communications through official channels only.