votes-saharaai[.]xyz

This domain, votes-saharaai.xyz, is flagged as a generic phishing threat specializing in cryptocurrency credential harvesting. Analysis indicates the infrastructure mimics decentralized governance or voting platforms, likely targeting users of blockchain-based decision-making systems. No explicit drainer kit signatures have been identified, but the domain’s structure and naming convention suggest an intent to deceive victims into submitting wallet private keys or seed phrases under the guise of participation in tokenized voting events. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 10, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. It resolves to the IP address 188.114.97.3, which has been linked to other malicious activities in recent threat intelligence reports. VirusTotal detection shows 1 out of 95 security vendors flagging the domain, while it appears on three distinct security blocklists. The domain has not been listed on Google Safe Browsing as of the latest scan, indicating either recent deployment or evasion of detection by major reputation systems. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. It has been blocked by multiple security frameworks, including browser extensions and wallet protection tools. Despite its inactive status, residual risk remains due to the domain’s recent creation date and the potential for re-registration or migration to new infrastructure. Users who interacted with the domain prior to its takedown should assume credential compromise and initiate wallet migration, revocation of active sessions, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.