Active multi-chain wallet-drainer phishing operation. governance-deed.estate is a clone of the legitimate deed.estate, running a fake "$DEED Rewards Date" governance-vote lure ("Register & Begin Voting"). It is one of 122+ domains (Flare/Firelight/Hyperliquid/Injective/OKX-vote/ether.fi "Vote on the Rewards Date" clones since 2026-07-28) that all load an EtherHiding wallet-drainer from the loader host pinky-goat.digital. The drainer's host pointer is stored and rotated every 30 minutes in an Arbitrum contract (0x967530969F5e5c94E0dC7247e9355e62e0ED65B2, owned by 0x1a906403a6f5F0352984865565Aa4dF18111b385). Victims connect a wallet and sign an approve/Permit2; the drainer pulls their tokens, splitting ~80% to the operator and ~20% to fee-sink 0xb0d9064875C70dd289d31bD8e13eAaBC0Cc84E06. Proceeds consolidate at 0x5db95fa0f6694ba8ad2077e507b2fd01d3eff858 and treasury 0x57fAC2a74B61245c6d221c99DFBE82d0260AF98e, then cash out via Relay and Butter Network (BSC to Tron USDT, tagged as an OKX Web3 Wallet route) and via Avalanche wallet 0x768a33dfa628cc8f320791e929184c16f64a22a7. Four of these wallets already carry HashDit "Fake_Phishing" tags on Etherscan/Snowtrace. Traced Ethereum victim losses so far ~$63k across 53 wallets.