voting-sanctum[.]xyz

This domain is flagged as an elevated-risk brand impersonation threat targeting Solana users through a fraudulent liquid staking portal. Analysis indicates the site operates as a crypto drainer, designed to trick victims into connecting wallets to malicious smart contracts that siphon funds upon interaction. The page title "Sanctum | Solana Liquid Staking Strategy" mimics legitimate Solana staking services, increasing the likelihood of successful social engineering attacks against cryptocurrency holders seeking yield opportunities. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain voting-sanctum.xyz was registered on May 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing operations. It resolves to IP address 188.114.96.3 and employs Cloudflare proxy services, including Cloudflare Browser Insights and HTTP/3, to obfuscate backend infrastructure. Detection metrics show 5/95 security vendors flagging the domain on VirusTotal, while Gridinsoft assigns a trust score of 0/100. The domain appears on three independent security blocklists and is actively blocked by wallet security tools and phishing prevention systems. Mitigation requires immediate action from both end users and security teams. Cryptocurrency holders should verify all staking portals through official Solana channels before connecting wallets, particularly those advertised via unsolicited messages or social media. Wallet providers should preemptively block interactions with this domain and monitor for derivative domains using similar naming patterns (e.g., sanctum-voting.xyz, solana-staking-portal.xyz). Network administrators should implement DNS sinkholing for 188.114.96.3 and monitor for connections to this IP from internal assets. Given the domain's current offline status, security teams should prioritize hunting for related infrastructure that may emerge using the same registrar or hosting patterns.