skygrove-vote[.]com

PhishDestroy has identified skygrove-vote.com as an active crypto drainer masquerading as a legitimate voting platform, risking irreversible cryptocurrency losses for unsuspecting users. This domain leverages deception to trick visitors into connecting crypto wallets under the guise of participation — a tactic increasingly used by threat actors to facilitate illicit fund transfers. Based on current telemetry, the domain is classified as under_investigation but remains highly dangerous due to its live operational status and low detection rates across security engines.

This domain was flagged by PhishDestroy with a risk level of under_investigation and is categorized as a generic phishing threat. Technical indicators reveal the domain was created on April 16, 2026, and resolves to IP address 104.21.92.212. VirusTotal currently shows 2 out of 95 detections, indicating it has evaded most antivirus engines. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, which has a neutral reputation, and it holds a valid Let's Encrypt SSL certificate, further enhancing its credibility to potential victims. These factors suggest a targeted, low-signature campaign designed to bypass early detection mechanisms.

Users are strongly advised to avoid interacting with skygrove-vote.com entirely. If you have already visited the site, do not connect any cryptocurrency wallets and immediately revoke any unintended permissions via your wallet provider’s security settings. Always verify URLs manually and cross-check domains against trusted sources like PhishDestroy before entering sensitive information. For organizations, implement DNS filtering rules to block access to this IP and domain. Report any interaction to your security team and consider monitoring wallet addresses involved in suspected scams. Stay vigilant — this threat is active and evolving, and proactive verification is the only reliable defense.