vote[.]deexscreener[.]fun

vote.deexscreener.fun — Crypto Drainer Phishing Campaign Identified

PhishDestroy identifies vote.deexscreener.fun as an active crypto drainer phishing domain targeting cryptocurrency users. The domain impersonates DeFi tools, specifically mimicking DEX Screener functionality to trick users into connecting wallets and signing malicious transactions. This campaign poses a critical risk to cryptocurrency holders due to its potential to drain digital assets via unauthorized transaction approvals. The threat remains live and under active exploitation by threat actors.

Technical analysis reveals the domain resolves to IP address 188.114.96.3 and operates with an SSL certificate issued by Let's Encrypt to facilitate HTTPS connections. Registered through Registrar of Domain Names REG.RU LLC on April 24, 2026, the domain has not yet been flagged by any of the 95 VirusTotal scanning vendors, indicating a low detection rate despite its malicious intent. Trust scores from threat intelligence platforms remain unverified due to its recent appearance, and no known blocklist entries have been recorded as of this report. The absence of detections suggests either a newly deployed campaign or deliberate evasion tactics by the threat actor group operating this infrastructure.

Given the absence of vendor detections and recent domain registration, this campaign represents a high-risk, emerging threat to cryptocurrency users. Immediate action is required to mitigate exposure: cybersecurity teams should block domain vote.deexscreener.fun and IP 188.114.96.3 at the network perimeter. Users are advised to verify website URLs before interacting with DeFi platforms, avoid connecting wallets to unfamiliar sites, and monitor wallet transactions for unauthorized activity. Enhanced monitoring of DEX Screener impersonations and similar cryptocurrency-themed domains is strongly recommended to detect potential follow-on attacks.