vote-coredao[.]org

This domain is flagged as a high-risk phishing infrastructure specifically designed to harvest cryptocurrency wallet credentials. Analysis indicates the site impersonates CoreDAO-related services, aiming to deceive users into disclosing private keys, seed phrases, or other sensitive authentication details through fraudulent login portals or fake airdrop claims. The threat type is classified as crypto-phishing, with a focus on credential theft and unauthorized asset transfer. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain vote-coredao.org was registered on June 09, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with malicious registrations. It is currently active and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious. The page title 'Just a moment...' suggests the use of anti-bot or cloaking techniques to evade automated detection and analysis. No legitimate association with CoreDAO or its official infrastructure has been verified. Mitigation requires immediate action from both users and network defenders. Users who may have interacted with vote-coredao.org should revoke any connected wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Network-level protections should include blocking DNS resolution for the domain, implementing web filtering rules to prevent access, and alerting on any internal connections to its IP addresses. Organizations should also conduct retrospective log analysis to identify potential exposure and educate users on recognizing crypto-phishing tactics, such as verifying domain authenticity and avoiding unsolicited airdrop or wallet verification prompts.