apps-ethena[.]xyz

Analysis indicates apps-ethena.xyz was registered on April 14 2026 through Dynadot LLC and currently resolves to IP address 104.21.22.133 located in Canada under Cloudflare infrastructure. Nameservers listed for the domain are sima.ns.cloudflare.com and tate.ns.cloudflare.com while the TLS certificate was issued by Let's Encrypt under serial E7. HTTP responses return status code 403 accompanied by the page title Just a moment which aligns with standard Cloudflare challenge behavior. VirusTotal reports detections from 3 out of 95 vendors and the domain appears in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100. The domain remains listed as active and is blocked by three named security mechanisms while appearing on three distinct blocklists. Registration details and infrastructure choices match patterns observed in recent high-risk generic phishing campaigns though direct attribution to a specific actor or campaign kit remains unconfirmed from the available telemetry. Uncertainties persist around the exact payload delivery mechanism because the HTTP 403 response prevents full content enumeration. The generic phishing classification rests primarily on aggregated vendor flags and prior blocklist entries rather than observed credential harvesting strings or live redirects. No ASN ownership data or brand impersonation strings beyond the domain string itself were supplied in the source intelligence. Defenders should add apps-ethena.xyz and its current IP 104.21.22.133 to internal block lists and DNS sinkholes immediately. Continued monitoring of the listed nameservers for additional subdomains and periodic rechecks of the same IP for other hosted domains are recommended to limit exposure. Organizations should also review authentication logs for any connections originating from the reported address range during the active period and enforce multi-factor verification on any related accounts that may have interacted with similar infrastructure.