app-ethena[.]eu[.]com

Analysis of the domain app-ethena.eu.com indicates it is actively serving as infrastructure for a cryptocurrency scam. The domain was registered on February 21, 2026, through Instra Corporation Pty Ltd, with nameservers hosted under CentralNic (ns1.centralnic.net through ns4.centralnic.net). Current resolution points to IP address 104.21.11.178, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The site returns an HTTP 521 status, suggesting server-side refusal of connections, while the visible page title displays a 522 timeout error, a pattern often observed in misconfigured or intentionally obscured phishing endpoints. Technical indicators reinforce the malicious classification. Only one of 95 security vendors on VirusTotal currently flags the domain, though this low detection rate may reflect evasion tactics rather than benign status. The domain appears on a single security blocklist, and Gridinsoft assigns a trust score of 0 out of 100. SSL certification is provided by Google Trust Services (WE1), a common choice for both legitimate and fraudulent sites. Cloudflare’s presence as a hosting intermediary further complicates attribution, as it masks direct server ownership while providing resilience against takedowns. The scam type is explicitly categorized as a crypto scam, though the exact mechanics—whether a wallet drainer, fake exchange, or investment fraud—remain unconfirmed due to the lack of accessible page content. The domain’s structure (app-ethena) suggests an attempt to impersonate a cryptocurrency platform, though no brand confirmation exists in the available data. Defenders should treat this domain as high-risk, particularly in environments where cryptocurrency transactions occur. Blocking resolution to 104.21.11.178 and monitoring for related subdomains under eu.com is recommended. Given the domain’s recent creation and active status, continued monitoring for shifts in hosting or content delivery is advised.