claim-ethena[.]ink

PhishDestroy has identified claim-ethena.ink as a crypto drainer domain, a type of threat specifically designed to steal cryptocurrency wallet credentials and assets. The domain appears to impersonate the Ethena brand, a legitimate decentralized finance protocol, to trick users into connecting their wallets or entering sensitive information. The page title found was 'Nur einen Moment…', a common placeholder that suggests the site may have been under construction or serving a redirect, further indicating malicious intent. This domain was created on November 10, 2025, making it extremely recent at the time of analysis, and registered through Web Commerce Communications Limited, a registrar often associated with low-quality or malicious domains.

Technical indicators provide strong evidence of the threat. VirusTotal reports that 3 out of 95 security vendors flagged the domain as malicious, a non-zero score that confirms community detection. The domain resolves to IP address 188.114.96.3, which is part of Cloudflare's infrastructure, often abused by attackers to hide their true hosting location. No SSL certificate was found, meaning any data transmitted would be unencrypted and easily intercepted. Additionally, the domain appears on 1 security blocklist, indicating it has been recognized by at least one threat intelligence feed. Google Safe Browsing status is not explicitly listed but given the blocklist presence, it is likely also flagged.

As of the latest check, claim-ethena.ink is offline, meaning the hosting provider or registrar may have taken action to suspend the domain. This is a positive development, but users should remain cautious as similar domains could reappear under different names. The remaining risk is low while the domain is inactive, but if users previously interacted with it, they should immediately revoke any wallet permissions and monitor for unauthorized transactions. PhishDestroy recommends always verifying the legitimacy of any site claiming to be a crypto platform by using official channels and cross-referencing with trusted security tools.