votesdexscreener[.]com

This domain is flagged as a cryptocurrency phishing portal targeting decentralized exchange users under the guise of a DEXVOTE service. Analysis indicates an elevated risk level due to its fraudulent intent to harvest credentials or private keys from unsuspecting victims interacting with blockchain-based platforms. Infrastructure analysis reveals the domain votesdexscreener.com was registered on May 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.146.173, hosted by Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services under the WE1 root. Detection metrics show 8 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Mitigation steps for this specific threat type include immediate blacklisting of the domain and associated IP address 172.67.146.173 across all network security controls. Organizations should verify SSL certificate transparency logs for additional fraudulent domains using the same Google Trust Services WE1 root. End users should be alerted to scrutinize any DEXVOTE-related communications, particularly those prompting wallet connections or private key submissions. Monitoring for newly registered domains with similar naming patterns through NICENIC INTERNATIONAL GROUP CO., LIMITED may help identify related campaigns.