voting-cypher[.]com

This domain is flagged as an elevated-risk crypto drainer targeting users of the Cypher Card service. Analysis indicates the infrastructure is designed to deceive victims into connecting cryptocurrency wallets, enabling unauthorized transfers of digital assets to attacker-controlled addresses. The specific threat type—crypto drainer—is confirmed by the page title impersonating Cypher Card, a legitimate crypto-to-fiat conversion service, and the domain’s presence on security blocklists specializing in financial fraud. Infrastructure analysis reveals the following data points: the domain voting-cypher.com was registered on February 21, 2026, through NiceNIC International Group Co., Limited. It resolves to IP address 172.67.153.103, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. The domain was taken offline following detection, but similar infrastructure may reappear under different names. Mitigation steps specific to crypto drainer threats include verifying domain authenticity before entering wallet credentials or recovery phrases. Users should cross-reference official service domains through verified sources, such as the legitimate platform’s website or trusted community channels. Enabling hardware wallet protections and multi-signature requirements for transactions can reduce exposure. If interaction with the domain occurred, affected parties should immediately revoke wallet permissions, transfer remaining assets to a new wallet, and monitor transaction histories for unauthorized activity. Security teams should block the domain and associated IP addresses at the network level to prevent further access.