voting-usdai[.]xyz

The domain voting-usdai.xyz has been identified as a generic phishing threat, likely impersonating a cryptocurrency voting platform to steal credentials or drain wallets. Although no specific brand or drainer kit was confirmed, the page title "Just a moment..." suggests a Cloudflare challenge, typical of phishing sites hiding malicious content. The domain was created on April 06, 2026, and registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar commonly abused by threat actors.

Technical analysis reveals that voting-usdai.xyz resolves to IP address 188.114.96.3, which is associated with Cloudflare's CDN. VirusTotal flags the domain with 3 out of 95 security vendors marking it as malicious, and it appears on 3 security blocklists. The SSL certificate is issued by Let's Encrypt (E7), providing a false sense of security. While the domain was not flagged by Google Safe Browsing at the time of analysis, it was found in 1 AlienVault OTX threat intelligence pulse, indicating active monitoring by the security community.

The domain has been taken offline, reducing immediate risk. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends avoiding any interaction with voting-usdai.xyz, not entering personal or wallet information on such sites, and reporting any suspicious links to security authorities. The combination of recent registration, low reputation, and phishing indicators makes this a confirmed threat.