dao-ethena[.]fi

This domain, dao-ethena.fi, is actively engaged in cryptocurrency draining operations under the guise of the Ethena platform. Analysis indicates the site is designed to impersonate legitimate Ethena services, tricking users into connecting wallets to malicious smart contracts that execute unauthorized transactions and asset transfers. The domain remains operational and poses a significant risk to users handling digital assets. Infrastructure analysis reveals the domain was registered on June 03, 2026, through Key-Systems GmbH and currently resolves to the IP address 188.114.96.3. Security vendors have flagged this domain, with 13 of 95 VirusTotal engines detecting malicious activity. The site appears on four security blocklists and is actively blocked by wallet security tools and browser extensions. Technologies detected include Cloudflare and HTTP/3, which may be leveraged to obfuscate malicious behavior or enhance phishing page delivery. The domain remains active and continues to pose a threat to users. Immediate precautions are advised, including blocking the domain at the network level, verifying wallet connections exclusively through official Ethena channels, and educating users on recognizing impersonation attempts. Monitoring for further indicators of compromise, such as unexpected transaction requests or unauthorized wallet access, is strongly recommended. Organizations should update their threat intelligence feeds to include this domain and its associated infrastructure.