ethena[.]fi-treasury[.]com

Analysis of ethena.fi-treasury.com indicates that the domain was registered on 21 February 2026 and is presently taken offline. The host resolves to 104.21.16.1, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented is identified as WE1, which offers no additional validation of the site’s legitimacy. A Gridinsoft trust score of 0 out of 100 places the domain in the lowest trust tier, and the site appears on two independent blocklists, PhishDestroy and ScamSniffer, both of which classify it as a crypto‑related scam.

VirusTotal analysis shows that one of ninety‑three scanned security vendors flagged the domain, reinforcing the suspicion of malicious intent. The page title returned by the HTTP request is “Just a moment…”, a generic placeholder that offers no insight into the content or intended victim lure. The listed scam type is “Crypto Scam”, suggesting that attackers may be attempting to harvest cryptocurrency credentials or lure victims into financial transactions.

No further indicators such as specific brand impersonation, login forms, or payloads have been observed, and the site’s content has not been publicly captured. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the IP address in other suspicious activity, and update intrusion‑detection signatures to include the observed TLS fingerprint and blocklist identifiers. Incident response teams should also verify that any internal accounts that may have interacted with the domain are inspected for unauthorized cryptocurrency activity.