ethenafi-rewards[.]xyz

Analysis of the domain ethenafi-rewards.xyz indicates active phishing infrastructure as of the report date, July 29, 2026. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 09, 2026 and immediately began appearing on three known security blocklists. Current blocklist presence is corroborated by multiple defensive products, including PhishDestroy, MetaMask, and SEAL, which have each listed the domain as malicious. DNS resolution points to the IP address 188.114.96.3, providing a single point of hosting for the observed activity.

VirusTotal scans show that five of ninety‑one security vendors have flagged the domain, reinforcing its classification as a phishing threat. The limited number of detections suggests that the campaign may be in early stages or employing evasion techniques to avoid broader detection. No additional intelligence such as SSL certificate details, HTTP response codes, or page title information is currently available, leaving the exact content and target brand of the malicious site unconfirmed.

Defenders should prioritize adding ethenafi-rewards.xyz to local deny lists and ensure that inbound and outbound traffic to the associated IP address, 188.114.96.3, is blocked at network perimeters. Continuous monitoring of the registrar and DNS records is advised to detect any re‑registration or IP changes. Integrating the domain into threat‑intelligence platforms and sharing the observed indicators with peer organizations will help broaden detection coverage and mitigate the elevated risk posed by this active phishing campaign.