vote-rhea[.]xyz

The domain vote-rhea.xyz has been identified as a generic phishing threat, specifically designed to impersonate RHEA Finance's governance platform. This type of phishing site typically aims to steal login credentials or private keys from unsuspecting users by mimicking legitimate DeFi interfaces. The domain was created on March 30, 2026, and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a common registrar for malicious domains.

Technical indicators from the intelligence report show that vote-rhea.xyz resolves to IP address 188.114.96.3, and VirusTotal flagged it with a score of 2 out of 95 security vendors, indicating some but not widespread detection. The site lacks an SSL certificate, which is unusual for legitimate financial platforms, and it appears on four security blocklists. Google Safe Browsing status is not explicitly stated but the domain has been taken offline.

The domain is currently offline, meaning the immediate phishing threat has been mitigated. However, users who may have visited the site before it was taken down should be cautious. PhishDestroy recommends that anyone who interacted with vote-rhea.xyz change their RHEA Finance passwords immediately and enable two-factor authentication. Remaining risk is low due to the domain being offline, but similar phishing sites may appear under different domains, so users should always verify URLs before entering sensitive information.