vote-phase2[.]vercel[.]app

This domain, vote-phase2.vercel.app, is actively engaged in cryptocurrency wallet credential harvesting, a high-risk phishing operation designed to extract private keys and recovery phrases from unsuspecting users. Analysis indicates the site employs deceptive interfaces mimicking legitimate wallet authentication flows, specifically targeting decentralized finance (DeFi) and non-custodial wallet users. The page title 'Just a moment...' suggests the use of intermediate loading screens to mask malicious intent, a common tactic in credential theft campaigns to evade immediate user detection. Infrastructure analysis reveals the domain is hosted on Vercel’s platform and resolves to the IP address 216.198.79.67. It is currently flagged by 11 out of 95 security vendors on VirusTotal, with detections spanning generic phishing, credential theft, and malicious web content categories. The domain appears on three independent security blocklists, including PhishDestroy and MetaMask’s threat intelligence feeds. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the underlying threat, as phishing domains frequently leverage valid certificates to appear legitimate. Users who have interacted with vote-phase2.vercel.app should immediately revoke any connected wallet sessions and transfer assets to a new, secure wallet. All credentials or recovery phrases entered on the site must be considered compromised. It is recommended to conduct a full system scan for malware, as phishing pages may deploy additional payloads. Affected individuals should monitor wallet addresses for unauthorized transactions and report the domain to relevant security teams for further mitigation.