votes-avantisfi[.]xyz

This domain is flagged as a high-risk DeFi credential phishing site targeting users of a decentralized finance platform. Analysis indicates the site mimics the legitimate Avantis interface to harvest wallet credentials, private keys, or seed phrases. Visitors are likely prompted to connect wallets or enter sensitive recovery information under false pretenses, such as account verification or reward claims. The site poses a direct financial risk to cryptocurrency holders, with potential for immediate asset theft upon credential submission. Infrastructure analysis reveals the domain was registered on March 16, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with phishing and fraudulent domains. As of the latest scan, 16 out of 95 security vendors on VirusTotal flagged the domain as malicious, with detections spanning phishing, fraud, and cryptocurrency theft categories. The domain resolves to IP address 104.21.32.96 and is proxied behind Cloudflare, a common tactic to obscure hosting infrastructure and evade takedowns. Technologies detected include Cloudflare Browser Insights and HTTP/3, further indicating an attempt to appear legitimate while monitoring user interactions. Users who visited votes-avantisfi.xyz or entered any credentials should assume compromise. Immediately revoke access for any connected wallets via the legitimate platform or wallet interface. Generate new wallet addresses and transfer all assets to them, as private keys or seed phrases may have been exposed. Monitor all linked accounts, including email and exchange logins, for unauthorized access. Reset passwords using a hardware-backed or offline method, and enable multi-factor authentication where available. Report the incident to the legitimate platform’s security team and consider filing a report with relevant cybercrime authorities. Avoid interacting with any links or communications related to this domain, as follow-up attacks may occur.