vote-plasma[.]eu[.]com

This domain, vote-plasma.eu.com, is flagged as an active crypto drainer phishing site targeting cryptocurrency wallet credentials. Analysis indicates the domain is designed to trick users into connecting wallets, enabling unauthorized fund transfers. The site remains operational as of the latest verification, posing a direct financial risk to visitors. Infrastructure analysis reveals the domain was registered on May 19, 2026, through Instra Corporation Pty Ltd, an uncommon registrar for legitimate financial services. It resolves to IP address 188.114.97.3, hosted by a content delivery network in Canada. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports 6 of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its low-cost automation. Current evidence confirms the domain remains active, with the page title displaying 'Just a moment...', a pattern consistent with phishing kits awaiting victim interaction. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to prevent access. Cryptocurrency wallet users should verify all transaction requests independently and avoid connecting wallets to unfamiliar sites. Security teams should monitor for related indicators, including the IP address and registrar details, to detect potential lateral movement or additional malicious domains.