byvotes[.]space

This domain, byvotes.space, is identified as a crypto drainer phishing site designed to impersonate legitimate voting or polling platforms to deceive users into connecting cryptocurrency wallets. Once connected, the site executes unauthorized transactions, draining digital assets from victims' wallets without consent. The threat specifically targets users through social engineering tactics, leveraging fake voting incentives or rewards to lower suspicion and prompt wallet connections. Analysis indicates the site employs obfuscated JavaScript to interact with wallet APIs, a common technique in crypto drainer schemes to bypass basic security checks. Infrastructure analysis reveals concrete indicators of malicious activity. The domain was registered on May 03, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with phishing campaigns. It resolves to the IP address 188.114.97.3 and is currently offline, though this does not mitigate prior exposure risks. Security vendors on VirusTotal flagged the domain at a rate of 3/95, while it appears on three independent security blocklists, including high-confidence threat intelligence feeds. Technologies detected include Node.js, Vue.js, and Nuxt.js, which are often used to create dynamic, interactive phishing interfaces. Additionally, the use of Cloudflare and HTTP/3 suggests an attempt to mask infrastructure and evade detection through encrypted traffic. Users who visited byvotes.space or interacted with its content should take immediate remedial actions. First, disconnect any cryptocurrency wallets that were linked to the site and revoke all active session permissions via wallet management interfaces. Monitor transaction histories for unauthorized activity and report suspicious transactions to the respective blockchain network or wallet provider. If credentials or private keys were entered, assume they are compromised and migrate assets to a new wallet with a fresh seed phrase. Scan local devices for malware using updated security tools, as phishing sites may deploy secondary payloads. Finally, report the domain to relevant security communities to aid in broader threat mitigation efforts.