centrifugevote[.]xyz

This domain, centrifugevote.xyz, is flagged as a crypto rewards scam designed to impersonate Centrifuge, a legitimate decentralized finance protocol. The phishing page displays a fabricated "Rewards Distribution Event" to lure victims into interacting with malicious smart contracts or disclosing wallet credentials. No specific drainer kit signatures were identified in initial scans, but the infrastructure aligns with known crypto phishing campaigns targeting token airdrop participants. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.142.103, hosted behind Cloudflare, which obscures origin server details. The domain appears on 3 security blocklists, though VirusTotal currently reports 0/95 detections. Technologies detected include HSTS, Cloudflare Browser Insights, and HTTP/3, suggesting a professionally configured phishing environment. The domain creation date is not publicly disclosed in available intelligence, and Google Safe Browsing status remains unconfirmed. As of the latest verification, centrifugevote.xyz has been taken offline, likely following abuse reports or hosting provider intervention. The domain was proactively blocked by wallet security extensions and phishing detection tools, including MetaMask and PhishDestroy. Despite its current offline status, the domain remains a residual risk due to potential re-activation or migration to alternative infrastructure. Organizations are advised to monitor for related domains using similar naming conventions (e.g., "centrifuge-[random-verb].xyz") and update blocklists accordingly. Users should verify all reward claims through official Centrifuge channels and avoid interacting with unsolicited token distribution links.