proposal-ethena[.]fi

proposal-ethena.fi was observed resolving to the Cloudflare‑owned address 188.114.97.3, which is registered to AS13335 in the United States. The domain was created on 10 Oct 2025 through the registrar Immaterialism Ltd and uses the Cloudflare nameservers kianchau.ns.cloudflare.com and meilani.ns.cloudflare.com. No TLS certificate is presented for the site, indicating that HTTPS is not configured. The only page title retrieved is “Pieni hetki…”, a Finnish phrase meaning “One moment…”, which does not reference a specific brand or service. The domain is classified as a crypto‑scam phishing site; Gridinsoft assigns it a trust score of 0 / 100, and ten of ninety‑five VirusTotal scanners have flagged it as malicious.

AlienVault OTX includes the domain in a single threat‑intel pulse, and PhishDestroy has already taken it offline and listed it on a security blocklist. The domain currently appears on one public blocklist and is not reachable at the time of this report. Analysis indicates that the infrastructure relies on Cloudflare’s CDN, a common tactic for fast‑flux or abuse‑resistant hosting. The lack of TLS, low trust score, and multiple vendor detections support the malicious assessment.

However, the offline status prevents real‑time content inspection, and the limited number of blocklist appearances leave open the possibility of additional undisclosed hosting or payload variations. Defenders should immediately add proposal-ethena.fi to DNS‑based deny lists and monitor for any resolution to the 188.114.97.3 address. Email and web security gateways should treat traffic to this domain as malicious, applying URL filtering rules consistent with crypto‑scam phishing. Continuous re‑evaluation is advised in case the site is re‑hosted or the threat actors modify the infrastructure.