multiplier-ethena[.]sbs

multiplier-ethena.sbs is flagged as a high‑risk generic phishing domain used for cryptocurrency fraud. The domain was registered on 21 February 2026 through Dynadot LLC and remains active. Its risk rating is high and it appears on two public blocklists, PhishDestroy and ScamSniffer, linking it to the broader campaign identified by seed c39af1.

Infrastructure analysis shows the domain resolves to 104.21.70.117, an address owned by AS13335 Cloudflare, Inc., with all traffic terminated behind Cloudflare’s edge network. The site presents a valid SSL certificate issued by Google Trust Services (WE1) and supports HTTP/3, confirming modern hosting. Authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, consistent with Cloudflare’s DNS service.

Web‑layer observations indicate an HTTP 200 response, yet the rendered page title reads "multiplier-ethena.sbs | 521: Web server is down", suggesting a deliberately misleading error state to evade casual inspection. VirusTotal scans report three of ninety‑five scanners flagging the domain as malicious, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The primary scam vector is identified as a crypto‑related bait, matching the generic_phishing classification.

Defenders should add 104.21.70.117 and the domain name to perimeter blocklists and enforce outbound filtering for known cryptocurrency phishing patterns. Continuous monitoring of the Cloudflare‑derived IP range for similar domains is advised, as the attacker may rotate hosts under the same provider. Endpoint telemetry should be tuned to detect user navigation to pages that return a 200 status while displaying a 521 error title, a behavior pattern observed here. User education campaigns should warn users that any unsolicited request to interact with "multiplier-ethena.sbs" is likely a fraudulent attempt to harvest credentials or crypto wallet information.