byvotes[.]site

PhishDestroy identifies byvotes.site as a generic crypto-draining domain, likely hosting a drainer kit designed to siphon cryptocurrency from unsuspecting victims. The domain does not impersonate a specific brand, suggesting a broad, opportunistic campaign targeting crypto users. Without evidence of a branded lure, the threat actor appears to rely on generic lures—such as fake voting platforms or reward schemes—to entice users into connecting their wallets and authorizing malicious transactions. This domain was flagged by PhishDestroy during routine threat hunting. Technical indicators include a VirusTotal detection rate of 0/95, a Let's Encrypt SSL certificate, resolution to IP 188.114.96.3, registration through HOSTINGER operations, UAB, and a creation date of April 29, 2026. As of this advisory, the domain remains unlisted on Google Safe Browsing (GSB) and has not been added to major blocklists, indicating low prior exposure and emphasizing the need for proactive defense. The domain is currently active and poses an elevated risk due to its zero-detection status and fresh infrastructure. Immediate actions include adding byvotes.site to network and endpoint blocklists, monitoring for outbound connections to 188.114.96.3, and inspecting DNS logs for resolution attempts. While the risk level remains under investigation, the combination of new registration, low VT coverage, and crypto-draining behavior warrants urgent containment. Users are advised to avoid visiting the domain and to verify all wallet connection requests via off-chain channels.