vote-felix[.]xyz

This domain, vote-felix.xyz, is identified as a high-risk crypto drainer phishing site targeting users with fraudulent wallet interaction prompts. Analysis indicates the site is designed to mimic legitimate cryptocurrency platforms, tricking victims into connecting their wallets, which may result in unauthorized transactions and asset theft. The page title 'Felix' suggests an attempt to impersonate a known service or project, increasing the likelihood of successful deception among users familiar with similar names. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, indicating limited but confirmed malicious classification. The domain was registered on May 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 172.67.128.17, hosted on Cloudflare infrastructure in Canada, a common tactic to obscure origin and evade takedowns. Additionally, the domain appears on 4 security blocklists, further validating its malicious status. Users who have visited vote-felix.xyz or interacted with its content should immediately disconnect any connected wallets and revoke permissions via their wallet settings. It is recommended to scan the device for malware using updated security tools and monitor all linked accounts for unauthorized activity. If assets were transferred, report the incident to relevant authorities and the platform where the theft occurred. Avoid re-engaging with the domain or any associated links, as it remains active and poses an ongoing threat.