vote-dexscreener[.]net

PhishDestroy identifies active brand impersonation and crypto-draining activity linked to the domain vote-dexscreener.net. This infrastructure targets users expecting legitimate crypto analytics by mimicking DexScreener, a widely used platform for tracking token trading activity. Visitors are lured through deceptive links embedded in social media, forums, or phishing emails, where the fraudulent site prompts wallet connections under false pretense—such as fake airdrops or token launches. Once connected, unsuspecting users expose their wallets to unauthorized fund transfers via embedded drainer scripts, a technique notorious for stealing digital assets within seconds. Domain analysis reveals low detection coverage with zero VirusTotal engines flagging the sample as malicious (3/95 detections), suggesting minimal exposure in threat intelligence feeds. The domain was registered on April 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP 172.67.214.26 with a valid Let’s Encrypt SSL certificate—an attribute often abused to convey trustworthiness. This combination of recent creation, low detection rate, and plausible infrastructure indicates ongoing development and deployment against real-world targets. Users who visited or entered wallet details are at immediate risk of unauthorized transactions and potential loss of crypto assets. Disconnect any active wallet sessions immediately and revoke any suspicious token approvals via blockchain explorers (e.g., Etherscan, BscScan). Avoid visiting the domain and report any wallet interactions to your security team or wallet provider. Security tools like browser allowlists and network blocklists should immediately include vote-dexscreener.net to prevent further exposure. This domain remains under active investigation with evolving indicators—monitor updated threat reports for new IOCs. Take corrective action without delay to mitigate asset loss.