proposal-ethena[.]xyz

The domain proposal-ethena.xyz is assessed at an elevated risk level and is specifically identified as a credential theft threat. This domain is designed to impersonate the legitimate Ethena App, aiming to trick users into divulging sensitive information such as login credentials.

Infrastructure analysis reveals that proposal-ethena.xyz is flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate level of detection by the security community. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 188.114.96.3. It was created on June 12, 2026, and is currently active. The domain appears on 4 security blocklists, including those maintained by MetaMask, PhishDestroy, SEAL, and ScamSniffer. Additionally, Gridinsoft has assigned the domain a trust score of 0 out of 100, reinforcing the high level of suspicion. The SSL certificate for the domain is issued by Google Trust Services, which may lend a false sense of security to unsuspecting users. The technologies detected on the domain include jsDelivr, crypto-js, Cloudflare Browser Insights, and Cloudflare, along with the use of HTTP/3.

To mitigate the risk of credential theft, users are advised to verify the legitimacy of the domain before entering any sensitive information. Organizations should update their security policies to block this domain and educate employees about the signs of phishing attempts. Network administrators should consider implementing DNS filtering and web proxy solutions to prevent access to the domain. Additionally, using multi-factor authentication (MFA) can significantly enhance security by adding an extra layer of protection against unauthorized access.