voting-ethena[.]fi

PhishDestroy identifies voting-ethena.fi as an active generic phishing domain operating with elevated risk. This domain mimics legitimate voting portals and is currently weaponized to harvest crypto wallet credentials and drain assets. The site presents a fake Ethena governance interface to trick users into connecting wallets and signing malicious transactions. No custom drainer kit fingerprint has been extracted from the page source yet, but the payload is consistent with clipboard-hijacking and signature-request abuse typical of generic phishing campaigns. Technical indicators confirm this domain is malicious. VirusTotal shows only 2 out of 95 security vendors flagged the URL as of the latest scan. The domain resolves to IP 172.67.136.70 and uses a Let’s Encrypt SSL certificate issued for authenticity. Registration data indicates the domain was created on March 27, 2026, which is unusually recent and suggests opportunistic bulk registration targeting emerging governance events. Google Safe Browsing has not yet blacklisted the domain, and public blocklist aggregators report zero third-party detections, increasing the window of exposure for potential victims. The campaign remains active as of the latest intelligence cycle. PhishDestroy analysts continue to monitor the domain’s infrastructure and payload delivery mechanisms. Immediate remediation includes blocking the domain at the network perimeter, flagging the IP 172.67.136.70 in firewall rules, and warning users not to interact with voting-ethena.fi or similar recently registered voting portals. Despite low vendor detection, the combination of recent registration, active hosting, and SSL issuance elevates the risk profile. Users should verify any Ethena-related governance link using PhishDestroy’s real-time verification tool before connecting wallets or signing transactions.