votings-ethena[.]xyz

This domain, votings-ethena.xyz, is actively engaged in crypto asset drainage, specifically impersonating Ethena, a cryptocurrency platform. The site remains operational as of the latest verification, presenting a high-risk threat to users interacting with its interface under the false pretense of legitimate Ethena services. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 16, 2024, not 2026 as initially noted, resolving to IP address 172.67.168.186. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend superficial legitimacy. Security vendors have detected malicious activity, with 2 of 95 VirusTotal engines flagging the domain. It appears on four distinct security blocklists, including those maintained by PhishDestroy, MetaMask, ScamSniffer, and SEAL. The page title, 'App | Ethena,' directly mimics the branding of the legitimate Ethena platform to deceive users. The domain remains active, and users are strongly advised to avoid interaction. Immediate steps include blocking the domain at the network level, updating endpoint protection rules to include the IP address 172.67.168.186, and alerting users to the presence of this crypto drainer. Monitoring for similar domains registered through the same registrar may help preempt further threats. Organizations should verify the legitimacy of any Ethena-related communications or web interfaces before engaging with them.