Fake Crypto Rewards-Voting Sites Aim to Drain Users’ Wallets
Summary
Malwarebytes found 70 fake crypto-project websites that lure users with rewards votes, then prompt them to connect wallets—potentially leading to malicious signatures or token approvals.
Key points
- The sites impersonate projects including xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, and NetNet.
- The fake vote opens a wallet-connection prompt; malicious follow-up signatures or transaction approvals could let attackers move tokens.
- The sites reuse templates and an identical wallet prompt, and their domains follow a shared sitemu[random characters].xyz pattern, suggesting a common operation or phishing kit.
- The article lists 70 domains as indicators of compromise.
- Verify rewards through official project channels and check the domain before connecting. Reject signatures or approvals you do not understand.
- If you signed or approved a transaction, review and revoke suspicious permissions; disconnecting alone does not revoke approvals.
Article Details
- Attack Vectors
- Fake websites impersonate crypto projects and offer a rewards boost in exchange for a vote. The Vote now button instead opens a wallet connection prompt.
- The Pendle copy uses fake dates and a countdown, while the NetNet copy warns that unclaimed tokens will be burned after 48 hours.
- The article warns that a subsequent malicious signature or token approval could let an attacker move tokens, but does not report that this happened to a visitor.
- Defensive Notes
- Verify votes and rewards through a project's official channels, and check the domain rather than relying on familiar branding.
- Reach project sites directly through a bookmark or a typed address instead of following links in messages, ads, or replies.
- Reject wallet requests for unexplained approvals, permits, transfers, or signatures; use a separate, low-balance wallet for unfamiliar sites.
- If already connected, disconnect. If a message was signed or a transaction approved, review and revoke suspicious token permissions; disconnecting alone does not revoke approvals.
- If a recovery phrase or private key may have been exposed, move remaining funds to a new wallet with a new recovery phrase.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | sitemufl06qs0r4o[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemui6m6bbj1bd[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemui8go6g99bb[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuicitd4jrtr[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuidkr38kji0[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuidlij5urd0[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuif3pa5k4eh[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuife3h91vjj[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuioeefbyh3i[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuioi7005ekb[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuizkhpdbjnv[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuj1xencnin8[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuj7lzbasipw[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujbcz1nas1x[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujdi54aitrf[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujejvp4tp0x[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujffobdhxgj[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuji07m137aw[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujoqrmsm0et[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujrfn7witew[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujsm7brhwh0[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujtcvh5q9fj[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujtd8ingh2b[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujtdkvy6c7n[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujufht1ntj4[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujufs1975v4[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujug76lkyke[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujumvtmjaf1[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujuncdlpnng[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujuno47vpud[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujunzgjapds[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujw19idqe01[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujw1uspghl1[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujwcvm5ufu8[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemujxjlv2lmhh[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk3jcm1olr8[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk3jpe1eph7[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk3z1hh2tvn[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk3zjrr2ufy[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk3zu5776gi[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk6zd201nsw[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7f31386dx[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7fi1dcrp4[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7fvnvihra[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7xbyszpzj[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7y434m4om[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7yi5eqn74[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk7ys6db9qj[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk9ayiwadjz[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuk9c4oppeco[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukh5awm67rj[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukpy2hpmpwv[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukrod1am6ez[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukvxv7j5hmv[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukvy7wudsqb[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukww7ivnaji[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemukwxih8302f[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemul94tcv4l80[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemul95f18sowo[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemul95pxqgmm8[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulaay8dbm66[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulaucnbmnrd[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulffos1qryn[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuli8pd7qi9z[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulpmt6if530[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulpnff7964j[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulpo7jkntfz[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulr9d1dg77r[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemuls00qrsh0k[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
| DOMAIN | sitemulszq4rm2yn[.]xyz | Domain listed as an indicator for the fake crypto-project sites. |
MITRE ATT&CK
Vendors
Products
Binance WalletIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.Bitget WalletIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.FirelightThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.KeetaThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.KinetiqThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.Malwarebytes Browser GuardMalwarebytes Browser Guard can block known phishing and scam sites before you interact with them.Malwarebytes Scam GuardIf you receive a link to a rewards vote, claim page, or airdrop and are unsure about it, Malwarebytes Scam Guard can help assess the link before you connect your wallet.MetaMaskIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.NetNetThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.OKX WalletIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.PendleThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.RabbyIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.Trust WalletIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.UmiaThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.WalletConnectIt lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, along with an option to browse more than 28 others.xStocksThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.Yield BasisThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.ZamaThe brands being copied include xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller platforms including Umia, Keeta, and NetNet.