vote-neptfinance[.]xyz

PhishDestroy analysts have flagged vote-neptfinance.xyz as an active crypto drainer designed to steal cryptocurrency from unsuspecting users. The site mimics the branding of Neptune Finance, a legitimate decentralized finance platform, to trick visitors into connecting their wallets and signing malicious transactions. Once a wallet is connected, the drainer silently transfers tokens to attacker-controlled addresses, often draining entire balances within seconds.

This domain was flagged after analysts observed zero detections on VirusTotal (1/95 engines) despite its recent creation on April 13, 2026. It resolves to IP 104.21.32.155 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com using a Let’s Encrypt SSL certificate, which may lend false credibility to visitors. The combination of low detection rates and active hosting suggests the threat actor is actively testing the domain against security tools before broader deployment.

If you visited vote-neptfinance.xyz or entered any wallet credentials, immediately disconnect your wallet, revoke any suspicious permissions, and transfer remaining assets to a clean wallet. Do not approve any pending transactions. Report the domain to PhishDestroy for takedown and scan your device with updated antivirus and anti-malware tools. Always verify URLs manually and use bookmarked links for trusted platforms—never click links from unsolicited messages.