# PhishDestroy domain threat record: voting-xstocks.lol

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/voting-xstocks.lol/
Machine-readable companion: https://phishdestroy.io/domain/voting-xstocks.lol/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 04:40:21 UTC
- Last availability or vendor check: 2026-10-21 22:32:54 UTC
- Stored record updated: 2026-10-22 14:25:02 UTC
- VirusTotal detections in the stored snapshot: 2/91
- Independent public blocklist matches in the stored snapshot: 3
- Matching public blocklists: MetaMask, ScamSniffer, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: MetaMask

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: Unknown
- Registration date (registry RDAP, voting-xstocks.lol): 2026-09-28 12:32:32 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb8c-e694-76e8-a64c-aba4437ef119/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/voting-xstocks.lol
- Certificate Transparency search: https://crt.sh/?q=%25.voting-xstocks.lol
- Web Archive lookup: https://web.archive.org/web/*/https://voting-xstocks.lol/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
voting-xstocks.lol posed as xStocks, a tokenized-equities brand, and showed the page title "xStocks - Tokenized Equities" to look like the real service. It targeted crypto users who hold or trade tokenized stocks. The "voting" prefix points to a governance or holder-vote pretext. PhishDestroy first flagged it on 2026-09-29. The site has been offline since 2026-09-30 and was still unreachable when checked on 2026-10-19.

How the scam works
Impersonation pages like this copy a real brand's look so visitors trust them. They then invent a reason to act, such as casting a vote, claiming an allocation or confirming holdings. The usual next step is a request to connect a wallet and sign a transaction, or to enter login details or a recovery phrase. A signature can hand the attacker permission to move tokens, and a seed phrase gives them the whole wallet. Nothing on such a page is a real xStocks vote. It only exists to capture access.

Evidence
VirusTotal showed only 2 of 91 engines flagging the domain on 2026-09-29, from Forcepoint ThreatSeeker and SOCRadar. That low count is typical for a domain caught within a day of going live. Wallet-focused security lists confirmed it independently: MetaMask, ScamSniffer and SEAL all block it alongside PhishDestroy. These are the lists that protect people at the moment they try to connect a wallet. The domain also appears in 4 AlienVault OTX threat pulses.

Infrastructure
The domain was registered through Eranet International Limited on 2026-09-28, one day before PhishDestroy detected it. That kind of timing fits a short-lived campaign built to run quickly before blocklists catch up. Traffic went through Cloudflare, Inc. (geolocated to CA), which hides the real origin server behind its proxy. The free Let's Encrypt certificate gave the page a padlock, but a padlock says nothing about whether a site is legitimate.

What to do
If you connected a wallet to this site, check your token approvals with a revocation tool and cancel any you don't recognise. Move remaining assets to a fresh wallet if you signed anything unusual. If you typed in a seed phrase, treat that wallet as compromised and transfer funds out right away from a clean device. If you entered an email or password, change it everywhere you reused it and turn on 2FA. Reach xStocks only through its official channels. Defenders should block the domain and watch for lookalike "voting" or "claim" domains using the same brand.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0eb8c-e694-76e8-a64c-aba4437ef119/
VirusTotal report: https://www.virustotal.com/gui/domain/voting-xstocks.lol
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=voting-xstocks.lol
Archived copy: https://web.archive.org/web/20260929044243/https://voting-xstocks.lol/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:15:16 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 05:06:35 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb8c-e694-76e8-a64c-aba4437ef119.png
  Captured: 2026-09-29 05:06:35 UTC
  Source report: https://urlscan.io/result/01a0eb8c-e694-76e8-a64c-aba4437ef119/
- URLScan capture 2: https://urlscan.io/screenshots/01a0e97e-4a21-756c-8580-479fe283aa6f.png
  Captured: 2026-09-29 04:40:21 UTC
  Source report: https://urlscan.io/result/01a0eb8c-e694-76e8-a64c-aba4437ef119/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/99f25a46-ba2e-4c09-b27e-a5bcc00777f8.png
  Captured: 2026-09-29 04:42:16 UTC
  Source report: https://radar.cloudflare.com/scan/99f25a46-ba2e-4c09-b27e-a5bcc00777f8
  SHA-256: 866020fd00802ce3cf6a7c0d7df96e2e323bb37575bac5a90401e312aac6a6bb
- URLQuery: https://screenshots.phishdestroy.io/uq/7c969bb7-ac12-4d97-b158-fd8c88c66ad2.png
  Source report: https://urlquery.net/report/7c969bb7-ac12-4d97-b158-fd8c88c66ad2
  SHA-256: df85d1a8661181068c74bd412f9d07edc40375705fea6329a3f3cb0934baa683
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e97e-4ad8-739b-8264-c025a4d9720f.png
  Captured: 2026-09-28 19:29:32 UTC
  Source report: https://urlscan.io/result/01a0e97e-4ad8-739b-8264-c025a4d9720f/
  SHA-256: 9b57f9744c6a2b7f61b62513fd5e9fdff943d4acb8c73bb7d7446e5fb735d522
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e97e-4a21-756c-8580-479fe283aa6f.png
  Captured: 2026-09-28 19:29:39 UTC
  Source report: https://urlscan.io/result/01a0e97e-4a21-756c-8580-479fe283aa6f/
  SHA-256: fcc55933d6804cd6e9c758dd4cb18a0bf064fb91c100576b2039482bb1713301
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb80-2cde-77ef-b78c-17c82940d2ab.png
  Captured: 2026-09-29 04:50:53 UTC
  Source report: https://urlscan.io/result/01a0eb80-2cde-77ef-b78c-17c82940d2ab/
  SHA-256: fcc55933d6804cd6e9c758dd4cb18a0bf064fb91c100576b2039482bb1713301
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb85-a3b5-716a-b470-4f2b4934a2b2.png
  Captured: 2026-09-29 04:56:45 UTC
  Source report: https://urlscan.io/result/01a0eb85-a3b5-716a-b470-4f2b4934a2b2/
  SHA-256: fcc55933d6804cd6e9c758dd4cb18a0bf064fb91c100576b2039482bb1713301
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb8a-60d6-747c-8112-69878206a570.png
  Captured: 2026-09-29 05:01:58 UTC
  Source report: https://urlscan.io/result/01a0eb8a-60d6-747c-8112-69878206a570/
  SHA-256: fcc55933d6804cd6e9c758dd4cb18a0bf064fb91c100576b2039482bb1713301

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:54:52Z",
        "uuid": "01a0eb8c-e694-76e8-a64c-aba4437ef119",
        "scanned_at": "2026-09-29T05:04:48Z",
        "final_url": "https://voting-xstocks.lol/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://voting-xstocks.lol/",
                "from": "http://voting-xstocks.lol/",
                "status": 307
            }
        ],
        "ip": "172.67.208.37",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com",
            "fynfue6gizxdkcyib7qzqxl6yplic3utnguuvmr3vhltij4lrsha.mainnet-1.datasprite-cdn.com",
            "zxdcgrwdlct5d5hkzf5ikt35hpxjgyetcpfzrvlhwzw2f6fnevbq.mainnet-1.datasprite-cdn.com",
            "6b5g7comjyz3c4cgalgs5qvnmcfq4arqkx6d2np6kdxclsrmnc6a.mainnet-1.datasprite-cdn.com",
            "nr37cg543n2zbiykifsgbtzl3tuysa2xn3ymy57xhyrvm3g2j2nq.mainnet-1.datasprite-cdn.com",
            "6sab273b7nl3rcdustvjejsgxkwzkkibobj56v5dumz7i6xdbltq.mainnet-1.datasprite-cdn.com",
            "jfrwbu3xjectzwr6zpvpvbewqkwb3tvpr7kikhkfa7gcmzugoycq.mainnet-1.datasprite-cdn.com",
            "t73giqqwtpkhhdyyeszo2vv4sqyyuafuk7y2deshpm3xftc7jg7q.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "142.251.163.94",
            "172.67.163.26",
            "104.21.15.158",
            "104.20.31.170",
            "172.253.62.95",
            "172.67.74.152",
            "172.67.70.222",
            "104.17.208.5",
            "104.21.17.203",
            "172.66.171.45",
            "172.67.70.45",
            "35.227.193.242",
            "104.18.11.59",
            "198.178.224.35",
            "104.20.24.117"
        ],
        "asns": [
            "15169",
            "13335",
            "396982",
            "396356"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "xstocks.fi",
            "defi.xstocks.fi",
            "docs.xstocks.fi",
            "www.linkedin.com",
            "x.com",
            "t.me",
            "www.kraken.com",
            "www.bybit.com",
            "phantom.com",
            "solana.com",
            "www.gate.com",
            "chain.link",
            "www.okx.com",
            "jup.ag",
            "www.bitget.com",
            "ethereum.org",
            "www.bnbchain.org",
            "www.mantle.xyz",
            "ton.org",
            "inkonchain.com",
            "web3.okx.com",
            "arbitrum.io",
            "tron.network",
            "optimism.io",
            "www.360x.com",
            "www.solflare.com",
            "trustwallet.com",
            "zerion.io",
            "morpho.org",
            "www.orca.so"
        ],
        "social": [
            "https://x.com/xstocksfi",
            "https://t.me/xstocksfi",
            "https://t.me/wallet",
            "https://discord.com/invite/xstocksfi"
        ],
        "doc_hash": "eae301b29910fa899cb734e27b2860859890c957d374cf412f76ee419646dc98",
        "script_hashes": [
            "e0c5ddb5c69a1620efd2e15155b5fe368887ea62e256cb765bdd2d9ed4180492",
            "b9838c97850bf4f463727cf5458d53d0940b4d93564ac40803b320518c79c38c",
            "4893e799c2418fe82767360d72575af60750e4ae88896ad2671c191f96f314c3",
            "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8"
        ],
        "globals": [
            "requestResize",
            "__kiwiJupiterDiscoveryReady",
            "__kiwiWalletStandardRegistry",
            "kiwiPro",
            "__earlyClickAction",
            "__removeEarlyClick",
            "__cfBeacon",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.voting-xstocks.lol",
                "voting-xstocks.lol"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "voting-xstocks.lol",
            "protocol": "QUIC",
            "valid_to": "2026-12-27T11:38:22Z",
            "valid_from": "2026-09-28T11:38:23Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 152,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:37Z",
        "uuid": "99f25a46-ba2e-4c09-b27e-a5bcc00777f8",
        "scanned_at": "2026-09-29T04:42:16Z",
        "final_url": "https://voting-xstocks.lol/",
        "status": 200,
        "history": [
            {
                "url": "https://voting-xstocks.lol/",
                "status": 200
            }
        ],
        "dom_hash": "bab6c23fed48067a80c535503c2205041613f0d7c33c5eab5e091c280429f06e",
        "doc_hash": "7b5fd530a4091b1a84d8150941162066594a02e83c8a64676c2e9adf8fc5a10d",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "voting-xstocks.lol",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "voting-xstocks.lol",
                "type": "A",
                "value": "188.114.97.0"
            },
            {
                "name": "voting-xstocks.lol",
                "type": "AAAA",
                "value": "2a06:98c1:3120::"
            },
            {
                "name": "voting-xstocks.lol",
                "type": "AAAA",
                "value": "2a06:98c1:3121::"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-28T12:32:32Z",
            "updated": "2026-09-28T12:32:33Z",
            "expires": "2027-09-28T23:59:59Z",
            "nameservers": [
                "denver.ns.cloudflare.com",
                "joyce.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:43:38Z",
        "analysis_at": "2026-10-14T07:25:31Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 2,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "SOCRadar": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "Eranet International Limited",
        "created": "2026-09-28T12:32:32Z",
        "expires": "2027-09-28T23:59:59Z",
        "updated": "2026-09-28T12:32:33Z",
        "first_seen": "2026-09-29T04:40:19Z",
        "dns": [
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "denver.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "denver.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::6815:fe0"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:d025"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.208.37"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "joyce.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.15.224"
            }
        ],
        "dns_at": "2026-09-29T06:21:55Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.voting-xstocks.lol",
                "voting-xstocks.lol"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "5c7c3be803fc686eb7675fdf4beca0f6a9e",
            "sha256": "51f64b72299d7fc176733beeec7e9cef81d702dd314f76f47455b9b734c8c682",
            "subject": "voting-xstocks.lol",
            "valid_to": "2026-12-27T11:38:22Z",
            "valid_from": "2026-09-28T11:38:23Z"
        },
        "whois": {
            "registrar": "Eranet International Limited",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-28T12:32:32Z",
            "updated": "2026-09-28T12:32:33Z",
            "expires": "2027-09-28T23:59:59Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "denver.ns.cloudflare.com",
                "joyce.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```