umbrasol-vote[.]com

umbrasol-vote.com has been confirmed as a crypto drainer active since its April 16, 2026 registration. The domain resolves to IP 172.67.204.220 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED using a Let’s Encrypt SSL certificate. MetaMask and SEAL have already blocked access, and the domain appears on two security blocklists. VirusTotal reports 4 out of 95 security vendors flag this domain, indicating a high-risk threat actor operating under the guise of legitimate services.

The threat type is a crypto drainer, designed to trick users into connecting wallets and draining funds under the fake Umbra identity. This domain was created recently and leverages trust in the Umbra brand to deceive victims. With a high-risk classification and active blocking by multiple security tools, the immediate danger to cryptocurrency users is significant. The domain’s SSL certificate, recent creation date, and presence on blocklists further confirm malicious intent and operational activity.

To mitigate risk, users should avoid accessing umbrasol-vote.com entirely. If accidentally visited, disconnect any wallet connections immediately and revoke any unintended permissions. Security teams should block this domain at the network level and update blocklists using the domain, IP 172.67.204.220, and associated SSL certificate fingerprints. Always verify URLs and use hardware wallets or transaction confirmation tools to prevent unauthorized crypto transfers.