claim-ethena[.]co

Analysis of claim-ethena.co shows a recently created domain (registered 22 September 2024) that has been associated with a crypto‑drainer scam. The domain is registered through OwnRegistrar, Inc. and is delegated to Cloudflare nameservers (donovan.ns.cloudflare.com, dora.ns.cloudflare.com). DNS resolution points to IP 104.21.40.9, an address owned by Cloudflare, Inc. and geolocated to the United States. The site does not present an SSL certificate, indicating that it was served over plain HTTP.

The only visible page title returned by the server is “Nur einen Moment…”, a generic placeholder that provides no indication of legitimate content. The domain appears on a single security blocklist, identified by PhishDestroy, and has been taken offline as of the current reporting date. VirusTotal records show that the domain was scanned by 95 antivirus and URL‑reputation engines, none of which raised a detection; however, the absence of a flag does not constitute confirmation of safety. No evidence of Safe Browsing, Open Threat Exchange, or other reputation services is available in the provided data.

The combination of a fresh registration, Cloudflare‑hosted IP, lack of TLS, and placement on a phishing blocklist aligns with typical infrastructure used for cryptocurrency‑draining operations. Defenders should continue to block claim‑ethena.co at perimeter and DNS layers, monitor for any resurgence of activity, and consider adding the domain to internal watchlists. Given the offline status, immediate remediation is limited, but the infrastructure footprint should be retained for correlation with future campaigns that employ similar Cloudflare‑based hosting and placeholder page titles.