vote-libertyswap[.]xyz

This domain is flagged as a high-risk cryptocurrency phishing site targeting users through deceptive wallet-drain mechanisms. Analysis indicates the site impersonates legitimate decentralized finance platforms, specifically under the guise of 'Liberty Swap,' to harvest credentials and private keys. The infrastructure and naming conventions strongly suggest an intent to exploit users seeking token swaps or liquidity provisioning, a common tactic in blockchain-related fraud campaigns. Infrastructure analysis reveals the domain vote-libertyswap.xyz was registered on June 16, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. The domain resolves to the IP address 104.21.60.129, a Cloudflare proxy endpoint that obscures the true hosting origin. Security vendor detections on VirusTotal report 5/95 flags from engines specializing in phishing and cryptocurrency fraud. The site is currently active and appears on four distinct security blocklists, including those maintained by blockchain security entities. The SSL certificate, issued by Google Trust Services (WE1), provides HTTPS encryption but does not validate legitimacy, as phishing sites routinely leverage trusted certificates to appear authentic. Mitigation requires immediate blocking of the domain and associated IP at the network perimeter. Endpoint protection systems should be updated to detect and prevent access to vote-libertyswap.xyz and any subdomains. Users who may have interacted with the site should revoke active wallet sessions, rotate private keys, and audit transaction histories for unauthorized activity. Security teams are advised to monitor for additional domains registered under the same registrar or resolving to the same IP range, as threat actors often deploy multiple lookalike domains in rapid succession. Verification of decentralized application interactions should be conducted exclusively through official, verified channels to prevent credential compromise.