vote-axelar[.]network

This domain, vote-axelar.network, is under investigation as a confirmed phishing site designed to target users of the Axelar network, a cross-chain communication protocol. Registered on July 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains active and resolves to the IP address 104.21.44.167, which is hosted on Cloudflare infrastructure, as indicated by its nameservers (jermaine.ns.cloudflare.com and vida.ns.cloudflare.com). The use of Cloudflare is a common tactic among threat actors to obscure the true origin of malicious sites and evade takedown efforts. As of July 26, 2026, the domain appears on one security blocklist, though it has not yet been flagged by any of the 91 vendors that scanned it on VirusTotal.

The absence of detections in VirusTotal does not confirm the domain's safety; rather, it may reflect a lag in detection or the use of evasion techniques. The domain's registration age—just five days old at the time of this report—aligns with typical phishing campaign timelines, where newly registered domains are frequently weaponized before detection mechanisms can respond. Infrastructure analysis reveals that the domain is configured to mimic governance or voting portals associated with Axelar, likely to deceive users into disclosing sensitive credentials or private keys. Defenders should treat this domain as high-risk, particularly for organizations or individuals involved in cross-chain or DeFi activities.

Immediate actions include blocking the domain at the DNS or firewall level, monitoring for connections to the IP 104.21.44.167, and alerting users to the potential threat. Given the domain's active status and the lack of widespread detection, further investigation is warranted to determine the full scope of the campaign, including any associated wallet addresses or secondary domains.