voting-lienfi[.]xyz

PhishDestroy identifies voting-lienfi.xyz as a cryptocurrency drainer scam domain currently under active investigation. This domain was flagged for its use of a generic drainer kit designed to steal cryptocurrency funds from unsuspecting victims. The threat actor behind this domain leverages deceptive domain names to impersonate legitimate services, specifically targeting users interested in voting-related financial activities. No specific brand or platform has been directly impersonated in this campaign, but the generic nature of the domain suggests opportunistic targeting of crypto users.

Technical indicators reveal this domain resolves to IP address 188.114.96.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 08, 2026. VirusTotal currently shows zero detections out of 95 engines, indicating a low detection rate among antivirus providers. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, and Google Safe Browsing (GSB) has not yet flagged the domain. As of this report, the domain remains unlisted on major threat intelligence blocklists, though this status may change as additional intelligence is gathered.

The domain is currently active and poses a moderate risk to users who may interact with it. PhishDestroy has flagged this domain for immediate review, and users are strongly advised to avoid visiting or interacting with voting-lienfi.xyz. Blocking the IP address 188.114.96.3 at the network level is recommended to prevent accidental access. While the current risk is under investigation, the lack of detections and active status warrant heightened caution. Users should report any suspicious activity related to this domain to their cybersecurity teams or relevant authorities to aid in ongoing analysis.