s7-ethena[.]app

Analysis of s7-ethena.app indicates an active generic phishing campaign as of August 05, 2026. The domain was created on the same date, suggesting immediate deployment for malicious purposes. Registration records show the registrar as Spaceship, Inc., and the authoritative nameservers are bingo.ns.cloudflare.com and neil.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

DNS resolution points to IP address 172.67.199.106, an address associated with Cloudflare’s content delivery network, a common choice for threat actors seeking to obscure origin. VirusTotal reports that the domain has been scanned by 91 security vendors, yet none have raised a detection flag; this absence of alerts does not constitute evidence of safety and may reflect limited visibility or evasion techniques. The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple security services have identified it as malicious and are actively denying access.

While no public page content, SSL certificate details, or brand‑targeting information have been disclosed, the combination of a freshly registered domain, Cloudflare hosting, and inclusion on reputable blocklists strongly supports the classification as a phishing vector. Defenders should immediately block the domain at network perimeters, update intrusion‑detection signatures, and monitor for any related indicators of compromise. Continuous re‑evaluation is advised, as additional telemetry such as payload samples or victim reports may emerge and refine the threat profile.