earnsvote-dexscreener[.]com

This domain, earnsvote-dexscreener.com, is a fraudulent cryptocurrency platform designed to impersonate legitimate decentralized exchange (DEX) voting interfaces. Analysis indicates the site mimics DEX Screener’s branding to deceive users into connecting wallets or submitting sensitive credentials under the guise of governance participation. The threat specifically targets cryptocurrency holders by presenting fake voting mechanisms that likely trigger malicious smart contracts or credential harvesting scripts upon interaction. The domain’s infrastructure is engineered to exploit trust in decentralized governance processes, a tactic increasingly observed in crypto drainer and phishing campaigns. Technical evidence confirms the domain’s malicious intent. VirusTotal reports 6 out of 95 security vendors flagging earnsvote-dexscreener.com as malicious, while it appears on 3 distinct security blocklists. The domain was registered on May 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site resolves to 104.21.78.42 and employs Cloudflare services, including HTTP/3 and Browser Insights, to obfuscate its origin and enhance phishing delivery. The SSL certificate issued by Google Trust Services further masks the site’s fraudulent nature, as legitimate-looking encryption is commonly exploited in phishing to lower user suspicion. Users who visited earnsvote-dexscreener.com or interacted with its content should take immediate action. Disconnect any connected wallets from the site and revoke permissions for all associated smart contracts using a blockchain explorer or wallet management tool. Scan local devices for malware, as phishing pages may deploy additional payloads. Monitor linked accounts for unauthorized transactions and enable transaction simulation tools to preview wallet interactions before execution. If credentials were entered, rotate passwords and enable multi-factor authentication on all cryptocurrency-related accounts. Report the domain to relevant security teams and blocklists to prevent further exploitation.