efhenafi[.]org

The domain efhenafi.org was registered through the RIPE NCC registry and currently resolves to the IPv4 address 186.2.163.160, which is advertised as belonging to AS59692 IQWeb FZ-LLC and is geolocated in Belize. The site’s HTTP response is offline, and the domain has been taken down by the hosting provider. No TLS certificate is presented for the host, meaning all communications would have been unencrypted if the site were reachable.

The page title returned during the brief online window was "Ethena | Crafting Dreams into Reality: Ethena Premier Construction & Renovation Services," indicating an attempt to impersonate a construction and renovation business. The domain is listed on a single security blocklist and has been flagged by the PhishDestroy mitigation service. VirusTotal analysis shows that four of ninety‑five security vendors submitted detections for this domain, confirming the presence of malicious indicators.

The available telemetry does not disclose additional infrastructure, such as secondary name servers or associated sub‑domains, and the limited blocklist exposure suggests minimal propagation at this stage. Defenders should immediately block efhenafi.org at perimeter and endpoint controls, incorporate the IP address 186.2.163.160 into network‑level deny lists, and monitor for any newly observed domains that resolve to the same ASN or share the same registrar footprint. Continuous observation of threat‑intel feeds for emerging detections related to the same page title or hosting provider is advised, as attackers may reuse the underlying infrastructure for future campaigns.