votes-nado[.]xyz

This domain is flagged as an elevated-risk crypto wallet drainer phishing site targeting cryptocurrency users. Analysis indicates it was designed to execute unauthorized transactions by tricking victims into connecting their wallets, enabling attackers to siphon funds directly from compromised accounts. Infrastructure analysis reveals the domain votes-nado.xyz was registered on April 4, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.56.218 and has been detected by 5 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists and holds a Gridinsoft trust score of 0/100. It has been blocked by multiple security feeds, including MetaMask, PhishDestroy, SEAL, and ScamSniffer, and is currently offline. Users who may have interacted with this domain should immediately revoke any wallet permissions granted to votes-nado.xyz via their wallet provider’s interface. Audit recent transactions for unauthorized activity and transfer remaining assets to a new, secure wallet. Enable hardware-based or multi-signature wallets for enhanced security. Monitor connected devices for malware, as phishing sites often deploy additional payloads. Report the domain to relevant security teams and wallet providers to aid in broader mitigation efforts.