votes-virtvals[.]com

This domain is flagged as an elevated-risk crypto-phishing site designed to impersonate the Virtuals Protocol, a platform associated with AI agent societies. Analysis indicates the threat specifically targets users through credential harvesting and wallet-drain attacks, leveraging social engineering tactics tied to artificial intelligence services. The domain exhibits characteristics consistent with targeted phishing campaigns against cryptocurrency holders and decentralized application users. Infrastructure analysis reveals the following technical indicators: votes-virtvals.com is detected by 6 out of 95 security vendors on VirusTotal, appears on 4 security blocklists, and resolves to the IP address 104.21.80.65. The domain was registered on June 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. The page title, 'Virtuals Protocol | Society of AI Agents,' directly mimics legitimate AI protocol platforms to deceive victims. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP (104.21.80.65) at the network perimeter. Organizations should update endpoint protection rules to flag the domain and its SSL certificate issuer as suspicious. Users should be educated on verifying domain authenticity before entering credentials or connecting wallets, particularly for platforms claiming AI integration. Cryptocurrency wallet providers are advised to monitor for connections to this domain and implement transaction signing delays when interactions with flagged infrastructure are detected. Historical analysis of the domain's creation date suggests potential long-term planning for this campaign, warranting heightened scrutiny of similarly structured domains.