domain-ens[.]app

This domain, domain-ens.app, is identified as a generic phishing infrastructure impersonating the Ethereum Name Service (ENS), a decentralized domain system for Ethereum wallets. Analysis indicates the domain is designed to deceive users into believing they are interacting with legitimate ENS services, likely to harvest wallet credentials or deploy malicious smart contracts for unauthorized fund transfers. No specific drainer kit has been conclusively linked to this domain at this time, but the infrastructure aligns with known cryptocurrency phishing campaigns targeting Web3 users. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 5 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It is registered through a privacy-protected service associated with Cloudflare, Inc., and resolves to the IP address 104.21.90.95, a Cloudflare proxy endpoint. The domain appears on four security blocklists, including those maintained by Codeesura, Polkadot, PhishDestroy, and Enkrypt. Gridinsoft assigns it a trust score of 0/100, reflecting high confidence in its malicious nature. The domain's creation date is not publicly disclosed, but its rapid inclusion in multiple blocklists suggests recent registration and active abuse. As of the latest assessment, domain-ens.app has been taken offline, likely due to hosting provider intervention or registrar enforcement actions. While the domain is no longer resolving, the underlying infrastructure—such as the IP address and registrar—remains a potential vector for future phishing campaigns. Users who interacted with this domain prior to its takedown may still be at risk of credential compromise or unauthorized transactions. It is recommended to revoke any connected wallet permissions, monitor for unusual activity, and verify domain authenticity before engaging with cryptocurrency services. The elevated risk level persists due to the domain's prior use in targeted phishing operations.