# PhishDestroy domain threat record: fables-votes.xyz Content language: English Canonical HTML report: https://phishdestroy.io/domain/fables-votes.xyz/ Machine-readable companion: https://phishdestroy.io/domain/fables-votes.xyz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-21 11:50:29 UTC - Last availability or vendor check: 2026-10-21 11:51:41 UTC - Stored record updated: 2026-10-21 16:10:10 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: uniswap ## Stored infrastructure - Observed IP address: 188.114.96.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Registrar country in stored WHOIS data: GB ## Evidence links - URLScan report: https://urlscan.io/result/01a15e4c-aafa-773d-9548-5315c22c27d8/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/fables-votes.xyz - Certificate Transparency search: https://crt.sh/?q=%25.fables-votes.xyz - Web Archive lookup: https://web.archive.org/web/*/https://fables-votes.xyz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI flagged fables-votes.xyz as malicious because the page prompts visitors to connect their crypto wallet to vote on a rewards date, a pattern typical of wallet‑drainer scams. The domain was first observed by PhishDestroy on 2026-10-21, when an HTTP 200 response was recorded for the exact hostname. How the scam works A wallet‑drainer scam presents a seemingly legitimate action—such as voting, claiming a reward, or accessing a feature—and asks the user to connect a cryptocurrency wallet. Once the user authorizes the connection, the attacker can request token transfers or contract approvals and subsequently move funds without further user interaction. Evidence urlscan captured the page on 2026-10-21 and returned a malicious verdict. VirusTotal’s domain scan on the same day reported one detection and labeled the domain suspicious, with Forcepoint ThreatSeeker providing the label. The VirusTotal URL scan showed no malicious verdict but was performed on 2026-10-21. Google Safe Browsing checked the domain on 2026-10-21 and did not flag it. PhishDestroy’s internal blocklist includes the domain, while external blocklists queried on that date returned no matches, and OTX listed zero pulses. Infrastructure The domain was registered on 2026-10-21 through NICENIC INTERNATIONAL GROUP CO., LIMITED. Hosting records show the domain resolved to IP 188.114.96.3, which belongs to the Cloudflare network (CloudFLARENET‑EU) and is associated with the United Kingdom. What to do Visitors should not connect any cryptocurrency wallet to the site; if a connection was already approved, revoke the permission and consider moving assets to a new wallet. Organizations should block the exact domain fables-votes.xyz in web filters and monitor outbound traffic for unauthorized wallet interactions. Review any logs for connections to this host and apply remediation steps only to this address, not to the broader Cloudflare or registrar infrastructure. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a15e4c-aafa-773d-9548-5315c22c27d8/ VirusTotal report: https://www.virustotal.com/gui/domain/fables-votes.xyz Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=fables-votes.xyz Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-21 11:52:07 UTC ## Stored page captures - Primary capture: https://i.ibb.co/3YftJpRr/77edd6a4b81b.png Captured: 2026-10-21 11:51:41 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a15e4c-aafa-773d-9548-5315c22c27d8.png Captured: 2026-10-21 11:51:41 UTC Source report: https://urlscan.io/result/01a15e4c-aafa-773d-9548-5315c22c27d8/ - URLScan capture 2: https://urlscan.io/screenshots/01a15e25-580f-75bb-9755-60b0d589560d.png Captured: 2026-10-21 11:50:29 UTC Source report: https://urlscan.io/result/01a15e4c-aafa-773d-9548-5315c22c27d8/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c94b4764-ab32-4e34-838b-45360f929ec5.png Captured: 2026-10-21 11:50:54 UTC Source report: https://radar.cloudflare.com/scan/c94b4764-ab32-4e34-838b-45360f929ec5 SHA-256: 2a669e2725667db8b622d49b0a86e8035bd6775ed8b455b5b45c10c8f5d30457 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e25-5978-763f-9be3-62a047307bd8.png Captured: 2026-10-21 11:07:59 UTC Source report: https://urlscan.io/result/01a15e25-5978-763f-9be3-62a047307bd8/ SHA-256: 061cbd7a7e9b373695c1fd6f0a94c3ce0b06b776fbde5a7e6802025ab6ddffd8 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15e25-580f-75bb-9755-60b0d589560d.png Captured: 2026-10-21 11:08:04 UTC Source report: https://urlscan.io/result/01a15e25-580f-75bb-9755-60b0d589560d/ SHA-256: 208d006e559a20e660045186c3a4f45cbd3c5796dfc60a03c4387a5b4200128d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T13:01:05Z", "uuid": "01a15e4c-aafa-773d-9548-5315c22c27d8", "scanned_at": "2026-10-21T11:50:55Z", "final_url": "https://fables-votes.xyz/rewards/", "status": 200, "ip": "188.114.96.3", "domains": [ "api.web3modal.org", "29c21a3f-a715-49bb-9c2f-fa37854d87fa.b-cdn.net", "fonts.reown.com", "ee3a7a8f-c428-460c-85ed-ac117609ed1d.b-cdn.net", "c69a0466-8bc3-469f-a7c9-0dce7876ba4b.com", "lb.drpc.live", "evm-rpc.sei-apis.com", "distinguished-newest-leaf.sei-pacific.quiknode.pro", "cdn.jsdelivr.net", "distinguished-newest-leaf.megaeth-mainnet.quiknode.pro" ], "ips": [ "104.20.46.121", "104.18.19.237", "104.21.46.249", "185.111.111.155", "185.26.10.103", "130.61.118.103", "104.20.29.245", "151.101.65.229", "188.114.96.3" ], "asns": [ "13335", "212238", "396356", "31898", "54113" ], "countries": [ "DE", "US" ], "link_domains": [ "www.fables.fi", "x.com", "t.me", "discord.gg", "www.coingecko.com", "defillama.com" ], "social": [ "https://x.com/fablesfi", "https://t.me/fablesfi", "https://discord.gg/QgeEq2rSv7" ], "doc_hash": "1d190b6c82e67975daeb9df41fbc9b95be27f9796319a5436e0f0cf5ab372bb4", "script_hashes": [ "fd7d50545c7ca8fdb187fadbdfe4267596b61c2b1cc953dbf318d31aaa30fc35", "1a7514ceef7cf3d419e86b2587d357b8e286c38e32e42de9d6a775980d400b5c" ], "globals": [ "ethers", "commonUtils", "userConfig", "behaviorData", "visitorData", "_headerElementsInserted", "showLoadingModal", "hideLoadingModal", "showToast", "closeToast", "showTransactionModal", "hideTransactionModal", "change_wallet", "showCaptcha", "litPropertyMetadata", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "config", "getInstance", "disconnect", "isActive", "_walletConnectCore__count", "_walletConnectCore_", "show", "__$G" ], "cookies": [ "visited" ], "storage_keys": [ "visit_counter", "wagmi.store", "@appkit/active_caip_network_id", "@appkit/active_namespace", "@appkit/connection_status", "cbwsdk.store", "@appkit/disconnected_connector_ids" ], "tls": { "san": [ "*.fables-votes.xyz", "fables-votes.xyz" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "fables-votes.xyz", "protocol": "TLS 1.3", "valid_to": "2027-01-19T09:50:43Z", "valid_from": "2026-10-21T09:50:44Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 114, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "genericcrypto" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Generic Crypto" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T11:51:33Z", "uuid": "c94b4764-ab32-4e34-838b-45360f929ec5", "scanned_at": "2026-10-21T11:50:54Z", "final_url": "https://fables-votes.xyz/", "status": 404, "history": [ { "url": "https://fables-votes.xyz/", "status": 404 } ], "dom_hash": "e5a234cb9304b15f34134b61a77b3718c6b9a63fe1299cafe25dcb3f16464ae1", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "fables-votes.xyz", "type": "A", "value": "104.21.1.163" }, { "name": "fables-votes.xyz", "type": "A", "value": "172.67.129.160" }, { "name": "fables-votes.xyz", "type": "AAAA", "value": "2606:4700:3034::ac43:81a0" }, { "name": "fables-votes.xyz", "type": "AAAA", "value": "2606:4700:3032::6815:1a3" } ], "dnssec_valid": false, "ip": "104.21.1.163", "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-21T10:20:00Z", "expires": "2027-10-21T23:59:59Z", "nameservers": [ "andronicus.ns.cloudflare.com", "leanna.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T11:50:50Z", "analysis_at": "2026-10-21T11:07:47Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 0, "suspicious": 1, "undetected": 38 }, "detections": { "Forcepoint ThreatSeeker": "suspicious" }, "reputation": 0, "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-21T10:20:00Z", "expires": "2027-10-21T23:59:59Z", "updated": "2026-10-20T16:00:00Z", "first_seen": "2026-10-21T10:55:19Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::6815:1a3" }, { "ttl": 300, "type": "A", "value": "172.67.129.160" }, { "ttl": 300, "type": "A", "value": "104.21.1.163" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::ac43:81a0" }, { "ttl": 21600, "type": "NS", "value": "leanna.ns.cloudflare.com" }, { "ttl": 21600, "type": "NS", "value": "andronicus.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "andronicus.ns.cloudflare.com" } ], "dns_at": "2026-10-21T11:08:09Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.fables-votes.xyz", "fables-votes.xyz" ], "issuer": "Let's Encrypt / YE2", "serial": "67a7f1e7a5be65bd784f839ab25530d9b43", "sha256": "5f0058b0226e4c1456803e6c99dd1b5e75b0c7e6309c5f8c79278d57097bf6b8", "subject": "fables-votes.xyz", "valid_to": "2027-01-19T09:50:43Z", "valid_from": "2026-10-21T09:50:44Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-20T16:00:00Z", "updated": "2026-10-20T16:00:00Z", "expires": "2027-10-21T16:00:00Z", "status": [ "addPeriod", "clientDeleteProhibited", "clientTransferProhibited", "serverTransferProhibited" ], "nameservers": [ "andronicus.ns.cloudflare.com", "leanna.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T11:51:52Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "fables-votes.xyz" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "162.159.38.151", "host": "leanna.ns.cloudflare.com" }, { "ip": "172.64.35.113", "host": "andronicus.ns.cloudflare.com" } ], "zone": "fables-votes.xyz" }, "location": { "ip": "2a06:98c1:3120::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "fables-votes.xyz" }, "dns": { "A": [ "188.114.97.9", "188.114.96.9" ], "NS": [ "andronicus.ns.cloudflare.com", "leanna.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"andronicus.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418065463, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::9", "2a06:98c1:3120::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3120::9", "family": 6 }, "tech_stack": { "technologies": [ "Cloudflare", "HTTP/3" ] }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-21T10:20:00Z", "updated": "2026-10-20T16:00:00Z", "expires": "2027-10-21T23:59:59Z", "status": [ "serverTransferProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientDeleteProhibited https://icann.org/epp", "addPeriod https://icann.org/epp" ], "nameservers": [ "andronicus.ns.cloudflare.com", "leanna.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare" } } } } ```