# PhishDestroy threat dossier — vote-dexscreener.net ================================================================ Fetched: 2026-04-27 14:27:31 UTC Canonical: https://phishdestroy.io/domain/vote-dexscreener.net/ ## VERDICT ---------------------------------------------------------------- HIGH THREAT — malicious activity confirmed Composite threat score: 70/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/95 security vendors flagged this domain URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.214.26 Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED !!! REGISTRAR INTEGRITY ALERT — NiceNIC !!! NiceNIC International: over 90% of its registered domains are associated with illegal content; documented systematic abuse-report non-response. Primary sources: https://phishdestroy.io/nicenic-real https://phishdestroy.io/nicenic-verdict Nameservers: barbara.ns.cloudflare.com, wilson.ns.cloudflare.com Registered: 2026-04-25 Page title: Just a moment... HTTP response: 403 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-07-24 Status: INVALID chain Fingerprint: 6c8bfcdb93fe18021ca6c66a7c755408a634fb20854de37369571c6b570730c3 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-26 16:52:10 UTC (by PhishDestroy tracker) First reported: 2026-04-26 13:52:22 UTC (abuse notice filed) Last verified: 2026-04-26 23:00:17 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dca0d-f2cd-727b-8f23-1814108ad20d/ URLQuery: https://urlquery.net/report/910e2eb4-0f1c-4aed-9b90-910c51dafa0f Wayback Machine: https://web.archive.org/web/*/vote-dexscreener.net crt.sh CT logs: https://crt.sh/?q=%25.vote-dexscreener.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=vote-dexscreener.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/vote-dexscreener.net URLhaus: https://urlhaus.abuse.ch/host/vote-dexscreener.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-26 16:53:22 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies active brand impersonation and crypto-draining activity linked to the domain vote-dexscreener.net. This infrastructure targets users expecting legitimate crypto analytics by mimicking DexScreener, a widely used platform for tracking token trading activity. Visitors are lured through deceptive links embedded in social media, forums, or phishing emails, where the fraudulent site prompts wallet connections under false pretense—such as fake airdrops or token launches. Once connected, unsuspecting users expose their wallets to unauthorized fund transfers via embedded drainer scripts, a technique notorious for stealing digital assets within seconds. Domain analysis reveals low detection coverage with zero VirusTotal engines flagging the sample as malicious (0/95 detections), suggesting minimal exposure in threat intelligence feeds. The domain was registered on April 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP 172.67.214.26 with a valid Let’s Encrypt SSL certificate—an attribute often abused to convey trustworthiness. This combination of recent creation, low detection rate, and plausible infrastructure indicates ongoing development and deployment against real-world targets. Users who visited or entered wallet details are at immediate risk of unauthorized transactions and potential loss of crypto assets. Disconnect any active wallet sessions immediately and revoke any suspicious token approvals via blockchain explorers (e.g., Etherscan, BscScan). Avoid visiting the domain and report any wallet interactions to your security team or wallet provider. Security tools like browser allowlists and network blocklists should immediately include vote-dexscreener.net to prevent further exposure. This domain remains under active investigation with evolving indicators—monitor updated threat reports for new IOCs. Take corrective action without delay to mitigate asset loss. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260426-5A0C61 Favicon MD5: a9dc2a5dcb1e7d936e0712524250cda1 TLS cert SHA-256: 6c8bfcdb93fe18021ca6c66a7c755408a634fb20854de37369571c6b570730c3 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/vote-dexscreener.net/ JSON API: https://api.destroy.tools/v1/check?domain=vote-dexscreener.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io