voting-ethena[.]app

This domain, voting-ethena.app, is identified as a high-risk generic phishing site targeting users of the Ethena protocol, a synthetic dollar and staking platform. Analysis indicates the domain impersonates Ethena’s governance voting portal, likely to harvest credentials or distribute malicious payloads under the guise of legitimate participation. No specific drainer kit signatures have been confirmed, but the domain’s structure and naming convention strongly suggest intent to deceive users into interacting with fraudulent governance proposals or wallet connections. Infrastructure analysis reveals the domain was registered on June 07, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It currently resolves to the IP address 104.21.39.148, a Cloudflare proxy endpoint, which obscures the true hosting origin. The domain’s SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy. VirusTotal detection shows 6 out of 95 security vendors flag the domain as malicious, while it appears on 3 distinct security blocklists. Notably, the domain is actively blocked by multiple cryptocurrency-focused security tools, including wallet protection and phishing detection systems. As of the latest verification, voting-ethena.app remains active and unresolved, posing an ongoing risk to users. The domain’s use of a future creation date (June 2026) suggests an attempt to evade automated detection systems that rely on domain age as a trust signal. Recommended response actions include immediate blacklisting at the DNS and network levels, as well as user education to verify governance portals through official Ethena channels. Despite mitigation efforts, the domain’s persistence and proxy-based hosting present a residual risk, necessitating continuous monitoring for shifts in infrastructure or payload delivery.