votes-internetcomputer[.]xyz

This domain poses as an official governance portal for the Internet Computer blockchain network, targeting users who participate in voting or token management. Visitors are likely presented with fake login interfaces or wallet connection prompts designed to harvest credentials, private keys, or seed phrases. The site may also distribute malicious software under the guise of governance tools or updates. Given the domain's focus on blockchain governance, the primary targets are cryptocurrency holders, developers, and validators who interact with Internet Computer's governance systems. Analysis indicates the domain was registered on June 13, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, hosted on Cloudflare's network (AS13335), which is commonly used to obscure the true origin of malicious infrastructure. At the time of assessment, 5 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appears on three independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), is legitimate but does not validate the site's authenticity, as phishing domains routinely use valid certificates to appear trustworthy. If you visited votes-internetcomputer.xyz or interacted with its content, immediately disconnect any connected wallets or accounts. Revoke any permissions granted to the site via wallet interfaces such as MetaMask or similar tools. Scan your device for malware using updated security software, as the site may have delivered malicious payloads. Monitor connected accounts for unauthorized transactions and change passwords or recovery phrases if credentials were entered. Report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts. Users should verify the authenticity of governance portals by cross-referencing official project communications and avoiding links from untrusted sources.