gov-ethena[.]xyz

Analysis of gov-ethena.xyz indicates a recent brand‑impersonation campaign targeting Google. The domain was registered through Dynadot on 19 November 2025 and resolves to 142.250.185.68, an address announced as belonging to AS15169 Google LLC in the United States. Despite the IP belonging to Google’s infrastructure, the domain is not hosted on Google’s legitimate services; it is pointed to the same IP range but lacks a valid SSL certificate, which is consistent with a quick‑deployment, low‑cost fraudulent site. Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com are in use, a pattern commonly observed in fast‑flux or disposable phishing infrastructure.

The page title returned by HTTP requests is the generic string “Google”, matching the declared brand target, and the site has been classified as a brand‑impersonation scam. The domain appears on the PhishDestroy blocklist, and eight of ninety‑five VirusTotal scanners have raised detections, reflecting moderate consensus among security vendors. Gridinsoft’s trust score of 0 / 100 further confirms its malicious reputation. Current monitoring shows the site is taken offline, which limits immediate exposure but does not eliminate the threat; the infrastructure may be re‑activated or reused for future campaigns.

Defenders should add gov‑ethena.xyz to network‑level deny lists, ensure DNS resolvers block the domain, and monitor for any resurgence of activity on the underlying IP address. Additional scrutiny of other domains registered by the same registrar within the past month is recommended, as well as continued observation of Cloudflare name‑server patterns that coincide with known phishing operators. Because the domain lacks HTTPS, any attempted connections would be rejected by browsers enforcing secure‑only policies, yet credential‑stealing scripts could still operate over HTTP if the site were reinstated.