vote-tangent[.]live

This domain is identified as a high-risk phishing site designed to harvest cryptocurrency wallet credentials. Analysis indicates it mimics legitimate wallet interfaces to deceive users into entering private keys or seed phrases, which are then exfiltrated to attacker-controlled infrastructure. The domain specifically targets users of decentralized finance (DeFi) platforms, where stolen credentials can result in immediate and irreversible asset theft. Given the financial nature of the threat, affected users may experience direct monetary loss within minutes of interaction. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It currently resolves to the IP address 188.114.97.3, which has been linked to other phishing campaigns in recent months. The domain is flagged by 3 out of 95 security vendors on VirusTotal, and it appears on 2 security blocklists, including those maintained by cryptocurrency security entities. The SSL certificate is issued by Google Trust Services, which, while legitimate, is commonly abused in phishing operations to lend false credibility to malicious sites. If a user has visited vote-tangent.live or entered any sensitive information, immediate action is required. First, disconnect the affected device from the internet to prevent further data exfiltration. Next, revoke any active sessions or approvals granted to decentralized applications (dApps) via the compromised wallet. Users should transfer all remaining assets to a new, secure wallet using a different device to avoid potential malware persistence. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actor.