vote-gizatech-com[.]pages[.]dev

This domain operates as a crypto wallet drainer, designed to trick users into connecting their wallets to fraudulent smart contracts that automatically siphon digital assets. The site mimics legitimate token claim portals, using social engineering tactics such as countdown timers and fake transaction confirmations to create urgency and bypass user scrutiny. Analysis of the page structure reveals embedded Web3 wallet connection prompts and obfuscated JavaScript functions commonly associated with malicious token approvals, confirming its intent to drain funds upon interaction. Infrastructure analysis reveals several high-risk indicators. The domain was registered through Cloudflare, Inc. on May 21, 2026, with an SSL certificate issued by Google Trust Services (WE1), suggesting an attempt to appear legitimate. Despite 0 detections out of 95 engines on VirusTotal, the domain appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. It resolves to the IP address 188.114.97.3, hosted by Cloudflare in Canada, a common pattern for newly deployed phishing infrastructure seeking to evade initial detection through reputable CDN services. Users who have visited vote-gizatech-com.pages.dev or interacted with its wallet connection prompts should immediately revoke any token approvals granted to unknown contracts using a blockchain explorer or wallet security tool. All connected wallets should be audited for unauthorized transactions, and affected users should transfer remaining assets to a new, secure wallet. Browser data, including cookies and cached scripts, should be cleared to remove any persistent tracking or session hijacking risks. Given the domain's active status and lack of widespread detection, caution is advised when encountering similar token claim or airdrop-themed sites, particularly those hosted on subdomains of content delivery platforms.