ethenafi[.]lat

Analysis of the domain ethenafi.lat, first observed on July 31, 2026, indicates that it is being used for a phishing operation. The domain resolves to the IP address 172.67.222.189, which is hosted on Cloudflare infrastructure as evidenced by the authoritative nameservers aron.ns.cloudflare.com and margo.ns.cloudflare.com. Registration records show the domain was created on the same date it was first seen, July 31, 2026, and the registrar listed is Spaceship, Inc. The domain has been added to a single security blocklist and is actively blocked by the PhishDestroy service, reinforcing the assessment of malicious intent.

VirusTotal reports that the domain was examined by 91 independent scanning engines, none of which produced a detection at the time of analysis; this lack of detections does not constitute a validation of safety and should be interpreted with caution. No additional public threat intelligence sources such as OTX or Google Safe Browsing have been cited for this domain, and no SSL certificate details, HTTP response codes, trust scores, or page title information are currently available. Defenders are advised to continue to block ethenafi.lat at network perimeters, update intrusion‑prevention signatures to include the associated IP address, and monitor for any future sightings of related infrastructure.

Ongoing observation of the registrar Spaceship, Inc. and the Cloudflare nameservers may reveal further indicators of compromise. Given the confirmed phishing classification and active status, the domain should be treated as hostile and excluded from trusted web traffic.