ethena[.]fi-s5[.]com

Analysis indicates that the domain ethena.fi-s5.com was registered on November 7, 2025, through registrar Name SRS AB. As of July 25, 2026, the domain resolves to IP address 172.67.175.73, hosted on Cloudflare infrastructure (AS13335) in the United States. No SSL certificate is present. The domain's HTTP response returns a page titled 'Just a moment...', a common placeholder or Cloudflare challenge page, suggesting the phishing content may have been removed or was never fully deployed. The scam type is classified as a crypto scam based on available intelligence.

Detection data shows the domain is flagged by 5 of 95 security vendors on VirusTotal and appears on 2 security blocklists. It is actively blocked by PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification. The domain's nameservers (laura.ns.cloudflare.com and milan.ns.cloudflare.com) and hosting on Cloudflare are consistent with phishing infrastructure, though Cloudflare itself is a legitimate service frequently abused by threat actors.

Defenders should treat this domain as compromised and block it at the network level. The absence of an SSL certificate and the generic placeholder page title do not indicate safety; phishing domains often cycle through multiple states, including inactive or placeholder phases. Given the domain's creation date, detection history, and blocklist presence, it remains a credible threat despite its current offline status. Further monitoring is recommended to track potential reactivation or migration to new infrastructure.