dex-votes[.]com

This domain, dex-votes.com, is actively flagged as a high-risk generic phishing threat targeting cryptocurrency users. Infrastructure analysis reveals it was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 104.21.41.21, hosted on Cloudflare's network in Canada. The domain's nameservers (darl.ns.cloudflare.com and laura.ns.cloudflare.com) and SSL certificate (issued by Google Trust Services, serial WE1) align with common phishing infrastructure patterns, though Cloudflare's proxy service obscures direct server details. The domain returns an HTTP 403 status with the page title 'Just a moment...', a default Cloudflare interstitial that suggests recent activation or deliberate evasion of automated crawlers. While the exact content remains unanalyzed, the domain appears on three security blocklists and is explicitly blocked by MetaMask and SEAL, indicating confirmed malicious activity targeting crypto-related services. AlienVault OTX lists it in one threat intelligence pulse, further corroborating its abuse status. Defenders should treat dex-votes.com as an active threat. The combination of recent registration, Cloudflare proxy usage, and targeted blocking by crypto-security tools strongly suggests it is being used for credential harvesting or wallet-draining attacks. Network-level blocking is recommended, and security teams should monitor for related domains using the same nameserver or registration patterns. No legitimate use case has been observed for this domain.