vote-felixcraftai[.]app

Analysis shows vote-felixcraftai.app was registered on March 03, 2026 and is currently resolving to IP 172.67.145.66, an address associated with a major content‑delivery network located in the United States under ASN 13335. The domain presents a TLS certificate issued by a free certificate authority (Let’s Encrypt) and serves HTTP/3 traffic. Automated scans return an HTTP 403 response and the page title "Just a moment...", a pattern often employed to conceal malicious redirects.

Threat intel indicates the site is classified as a crypto‑drainer, specifically targeting wallet credentials for extraction. Four out of ninety‑five security vendors on a public scanning platform have flagged the domain, and a reputable endpoint‑trust rating assigns it a zero score out of one hundred, confirming a high confidence in its malicious nature. The domain appears on three independent blocklists and is actively blocked by multiple anti‑phishing and cryptocurrency‑wallet protection tools.

Infrastructure observations reveal the use of a CDN service with built‑in browser analytics and HTTP/3 support, which aids in obfuscating the origin server and complicating forensic tracing. The hosting provider's nameservers, listed as adam.ns and danica.ns, are standard for the CDN’s network, further concealing the underlying command‑and‑control infrastructure. No additional infrastructure details beyond the CDN address are observable, leaving the downstream payload delivery mechanisms uncertain.

Defenders should block the domain at perimeter defenses and DNS resolvers, monitor for outbound connections to the associated IP, and enforce strict validation of cryptocurrency transaction requests. Incident response teams should also correlate any wallet access attempts with the observed page title and HTTP 403 response pattern to identify potential compromise. Continuous monitoring of the domain’s reputation scores and blocklist status is recommended, as the active risk level remains high.