vote-squidrouter[.]xyz

This domain is flagged as a high-risk crypto drainer phishing site targeting users through deceptive transaction prompts. Analysis indicates the infrastructure is designed to exploit wallet connections, draining funds via malicious smart contract interactions. The domain exhibits multiple indicators of compromise, including absence of security controls and association with known threat actor infrastructure. Infrastructure analysis reveals the domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently observed in phishing operations. It currently resolves to IP address 172.67.151.77, hosted on Cloudflare's network (AS13335). The domain lacks SSL certification, a critical security gap for credential harvesting. VirusTotal reports 1/95 security vendors flagging the domain as malicious. It appears on four security blocklists, including entries from PhishDestroy, MetaMask, ScamSniffer, and SEAL, confirming its classification as active phishing infrastructure. Mitigation requires immediate blocking of the domain and associated IP at network and endpoint levels. Users should revoke permissions for any connected wallets via blockchain explorers and monitor transaction histories for unauthorized activity. Organizations should update phishing detection rules to include this domain and its registrar as indicators of compromise. Given the domain's active status and lack of SSL, all interactions should be treated as hostile until verified through independent channels.