centrifugevote[.]com

This domain, centrifugevote.com, is identified as a crypto drainer phishing site targeting users of the Centrifuge protocol, a platform specializing in onchain asset management. The phishing page mimics the legitimate Centrifuge interface, as evidenced by the identical page title, 'Centrifuge | Infrastructure for Onchain Asset Management,' and the use of associated branding elements. Analysis indicates the presence of a drainer kit designed to siphon cryptocurrency assets from victims' wallets upon interaction, a common tactic in decentralized finance (DeFi) phishing campaigns. No specific drainer kit variant has been conclusively attributed at this stage, though the integration of technologies such as Sendgrid and reCAPTCHA suggests an attempt to lend legitimacy and facilitate credential harvesting or transaction manipulation. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in phishing operations. It resolves to the IP address 104.26.14.223, which is associated with a content delivery network (CDN) known for hosting both legitimate and malicious content. As of the latest assessment, the domain has not been flagged by VirusTotal, with a detection score of 0/95. However, it appears on three security blocklists, indicating prior identification by threat intelligence platforms. Google Safe Browsing (GSB) status remains unconfirmed, but the domain is actively blocked by multiple wallet security extensions and community-driven blocklists. The Gridinsoft trust score of 0/100 further corroborates the malicious classification, despite the current offline status. The domain is presently offline, likely due to takedown efforts or voluntary suspension by the hosting provider. However, the residual risk remains elevated due to the domain's recent registration date, which predates its intended use by several years—a red flag commonly associated with domain squatting or preemptive registration for malicious purposes. Users who interacted with the site prior to its takedown are advised to immediately revoke any wallet permissions, monitor transaction histories for unauthorized activity, and consider migrating assets to a new wallet if compromise is suspected. Organizations and individuals operating in the DeFi space should treat this domain as a confirmed phishing indicator and update their blocklists accordingly. Continuous monitoring of newly registered domains under similar naming conventions is recommended to preempt future threats.