Phishing & fraudmedium
Fake xStocks, Pendle, and other sites bait crypto users with rewards votes
AI summary · glm-5.3Summaries by Vani AI
Malwarebytes found 70 cloned crypto sites impersonating xStocks, Pendle, Zama and others that trick users into wallet connections and malicious token approvals.
Malwarebytes identified 70 lookalike domains (sitemu*.xyz) closely cloning crypto projects including Kraken's xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Keeta and NetNet. The pages bait users with a fake vote on a rewards date promising a 1.25x boost, but the Vote button opens an identical wallet-connection prompt listing WalletConnect, MetaMask, Trust Wallet, OKX, Binance, Bitget and Rabby. A malicious approval or signature afterwards can let the operator drain tokens, and blockchain transactions cannot be reversed. Shared templates, identical wording and the same wallet window across brands indicate a single phishing kit or operation.
Key facts
- 70 .xyz lookalike domains clone crypto brands with fake rewards votes
- Vote button opens wallet connect; later approvals can drain tokens irreversibly
- Targets projects with recent token launches, airdrops or points programs
- Identical templates and wallet window indicate one phishing operation
- Threat actors
- Kraken
- Organizations
- MalwarebytesPendleZamaMetaMaskWalletConnect
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | sitemufl06qs0r4o.xyz | e project’s official channels too. Indicators of compromise sitemufl06qs0r4o[.]xyz sitemui6m6bbj1bd[.]xyz sitemui8go6g99bb[.]xyz sitemuicitd |
| domain | sitemui6m6bbj1bd.xyz | annels too. Indicators of compromise sitemufl06qs0r4o[.]xyz sitemui6m6bbj1bd[.]xyz sitemui8go6g99bb[.]xyz sitemuicitd4jrtr[.]xyz sitemuidkr3 |
| domain | sitemui8go6g99bb.xyz | of compromise sitemufl06qs0r4o[.]xyz sitemui6m6bbj1bd[.]xyz sitemui8go6g99bb[.]xyz sitemuicitd4jrtr[.]xyz sitemuidkr38kji0[.]xyz sitemuidlij |
| domain | sitemuicitd4jrtr.xyz | 6qs0r4o[.]xyz sitemui6m6bbj1bd[.]xyz sitemui8go6g99bb[.]xyz sitemuicitd4jrtr[.]xyz sitemuidkr38kji0[.]xyz sitemuidlij5urd0[.]xyz sitemuif3pa |
| domain | sitemuidkr38kji0.xyz | 6bbj1bd[.]xyz sitemui8go6g99bb[.]xyz sitemuicitd4jrtr[.]xyz sitemuidkr38kji0[.]xyz sitemuidlij5urd0[.]xyz sitemuif3pa5k4eh[.]xyz sitemuife3h |
| domain | sitemuidlij5urd0.xyz | o6g99bb[.]xyz sitemuicitd4jrtr[.]xyz sitemuidkr38kji0[.]xyz sitemuidlij5urd0[.]xyz sitemuif3pa5k4eh[.]xyz sitemuife3h91vjj[.]xyz sitemuioeef |
| domain | sitemuif3pa5k4eh.xyz | td4jrtr[.]xyz sitemuidkr38kji0[.]xyz sitemuidlij5urd0[.]xyz sitemuif3pa5k4eh[.]xyz sitemuife3h91vjj[.]xyz sitemuioeefbyh3i[.]xyz sitemuioi70 |
| domain | sitemuife3h91vjj.xyz | r38kji0[.]xyz sitemuidlij5urd0[.]xyz sitemuif3pa5k4eh[.]xyz sitemuife3h91vjj[.]xyz sitemuioeefbyh3i[.]xyz sitemuioi7005ekb[.]xyz sitemuizkhp |
| domain | sitemuioeefbyh3i.xyz | ij5urd0[.]xyz sitemuif3pa5k4eh[.]xyz sitemuife3h91vjj[.]xyz sitemuioeefbyh3i[.]xyz sitemuioi7005ekb[.]xyz sitemuizkhpdbjnv[.]xyz sitemuj1xen |
| domain | sitemuioi7005ekb.xyz | pa5k4eh[.]xyz sitemuife3h91vjj[.]xyz sitemuioeefbyh3i[.]xyz sitemuioi7005ekb[.]xyz sitemuizkhpdbjnv[.]xyz sitemuj1xencnin8[.]xyz sitemuj7lzb |
| domain | sitemuizkhpdbjnv.xyz | 3h91vjj[.]xyz sitemuioeefbyh3i[.]xyz sitemuioi7005ekb[.]xyz sitemuizkhpdbjnv[.]xyz sitemuj1xencnin8[.]xyz sitemuj7lzbasipw[.]xyz sitemujbcz1 |
| domain | sitemuj1xencnin8.xyz | efbyh3i[.]xyz sitemuioi7005ekb[.]xyz sitemuizkhpdbjnv[.]xyz sitemuj1xencnin8[.]xyz sitemuj7lzbasipw[.]xyz sitemujbcz1nas1x[.]xyz sitemujdi54 |
| domain | sitemuj7lzbasipw.xyz | 7005ekb[.]xyz sitemuizkhpdbjnv[.]xyz sitemuj1xencnin8[.]xyz sitemuj7lzbasipw[.]xyz sitemujbcz1nas1x[.]xyz sitemujdi54aitrf[.]xyz sitemujejvp |
| domain | sitemujbcz1nas1x.xyz | hpdbjnv[.]xyz sitemuj1xencnin8[.]xyz sitemuj7lzbasipw[.]xyz sitemujbcz1nas1x[.]xyz sitemujdi54aitrf[.]xyz sitemujejvp4tp0x[.]xyz sitemujffob |
| domain | sitemujdi54aitrf.xyz | encnin8[.]xyz sitemuj7lzbasipw[.]xyz sitemujbcz1nas1x[.]xyz sitemujdi54aitrf[.]xyz sitemujejvp4tp0x[.]xyz sitemujffobdhxgj[.]xyz sitemuji07m |
| domain | sitemujejvp4tp0x.xyz | zbasipw[.]xyz sitemujbcz1nas1x[.]xyz sitemujdi54aitrf[.]xyz sitemujejvp4tp0x[.]xyz sitemujffobdhxgj[.]xyz sitemuji07m137aw[.]xyz sitemujoqrm |
| domain | sitemujffobdhxgj.xyz | z1nas1x[.]xyz sitemujdi54aitrf[.]xyz sitemujejvp4tp0x[.]xyz sitemujffobdhxgj[.]xyz sitemuji07m137aw[.]xyz sitemujoqrmsm0et[.]xyz sitemujrfn7 |
| domain | sitemuji07m137aw.xyz | 54aitrf[.]xyz sitemujejvp4tp0x[.]xyz sitemujffobdhxgj[.]xyz sitemuji07m137aw[.]xyz sitemujoqrmsm0et[.]xyz sitemujrfn7witew[.]xyz sitemujsm7b |
| domain | sitemujoqrmsm0et.xyz | vp4tp0x[.]xyz sitemujffobdhxgj[.]xyz sitemuji07m137aw[.]xyz sitemujoqrmsm0et[.]xyz sitemujrfn7witew[.]xyz sitemujsm7brhwh0[.]xyz sitemujtcvh |
| domain | sitemujrfn7witew.xyz | obdhxgj[.]xyz sitemuji07m137aw[.]xyz sitemujoqrmsm0et[.]xyz sitemujrfn7witew[.]xyz sitemujsm7brhwh0[.]xyz sitemujtcvh5q9fj[.]xyz sitemujtd8i |
| domain | sitemujsm7brhwh0.xyz | 7m137aw[.]xyz sitemujoqrmsm0et[.]xyz sitemujrfn7witew[.]xyz sitemujsm7brhwh0[.]xyz sitemujtcvh5q9fj[.]xyz sitemujtd8ingh2b[.]xyz sitemujtdkv |
| domain | sitemujtcvh5q9fj.xyz | rmsm0et[.]xyz sitemujrfn7witew[.]xyz sitemujsm7brhwh0[.]xyz sitemujtcvh5q9fj[.]xyz sitemujtd8ingh2b[.]xyz sitemujtdkvy6c7n[.]xyz sitemujufht |
| domain | sitemujtd8ingh2b.xyz | n7witew[.]xyz sitemujsm7brhwh0[.]xyz sitemujtcvh5q9fj[.]xyz sitemujtd8ingh2b[.]xyz sitemujtdkvy6c7n[.]xyz sitemujufht1ntj4[.]xyz sitemujufs1 |
| domain | sitemujtdkvy6c7n.xyz | 7brhwh0[.]xyz sitemujtcvh5q9fj[.]xyz sitemujtd8ingh2b[.]xyz sitemujtdkvy6c7n[.]xyz sitemujufht1ntj4[.]xyz sitemujufs1975v4[.]xyz sitemujug76 |
| domain | sitemujufht1ntj4.xyz | vh5q9fj[.]xyz sitemujtd8ingh2b[.]xyz sitemujtdkvy6c7n[.]xyz sitemujufht1ntj4[.]xyz sitemujufs1975v4[.]xyz sitemujug76lkyke[.]xyz sitemujumvt |
| domain | sitemujufs1975v4.xyz | 8ingh2b[.]xyz sitemujtdkvy6c7n[.]xyz sitemujufht1ntj4[.]xyz sitemujufs1975v4[.]xyz sitemujug76lkyke[.]xyz sitemujumvtmjaf1[.]xyz sitemujuncd |
| domain | sitemujug76lkyke.xyz | kvy6c7n[.]xyz sitemujufht1ntj4[.]xyz sitemujufs1975v4[.]xyz sitemujug76lkyke[.]xyz sitemujumvtmjaf1[.]xyz sitemujuncdlpnng[.]xyz sitemujuno4 |
| domain | sitemujumvtmjaf1.xyz | ht1ntj4[.]xyz sitemujufs1975v4[.]xyz sitemujug76lkyke[.]xyz sitemujumvtmjaf1[.]xyz sitemujuncdlpnng[.]xyz sitemujuno47vpud[.]xyz sitemujunzg |
| domain | sitemujuncdlpnng.xyz | s1975v4[.]xyz sitemujug76lkyke[.]xyz sitemujumvtmjaf1[.]xyz sitemujuncdlpnng[.]xyz sitemujuno47vpud[.]xyz sitemujunzgjapds[.]xyz sitemujw19i |
| domain | sitemujuno47vpud.xyz | 76lkyke[.]xyz sitemujumvtmjaf1[.]xyz sitemujuncdlpnng[.]xyz sitemujuno47vpud[.]xyz sitemujunzgjapds[.]xyz sitemujw19idqe01[.]xyz sitemujw1us |
| domain | sitemujunzgjapds.xyz | vtmjaf1[.]xyz sitemujuncdlpnng[.]xyz sitemujuno47vpud[.]xyz sitemujunzgjapds[.]xyz sitemujw19idqe01[.]xyz sitemujw1uspghl1[.]xyz sitemujwcvm |
| domain | sitemujw19idqe01.xyz | cdlpnng[.]xyz sitemujuno47vpud[.]xyz sitemujunzgjapds[.]xyz sitemujw19idqe01[.]xyz sitemujw1uspghl1[.]xyz sitemujwcvm5ufu8[.]xyz sitemujxjlv |
| domain | sitemujw1uspghl1.xyz | o47vpud[.]xyz sitemujunzgjapds[.]xyz sitemujw19idqe01[.]xyz sitemujw1uspghl1[.]xyz sitemujwcvm5ufu8[.]xyz sitemujxjlv2lmhh[.]xyz sitemuk3jcm |
| domain | sitemujwcvm5ufu8.xyz | zgjapds[.]xyz sitemujw19idqe01[.]xyz sitemujw1uspghl1[.]xyz sitemujwcvm5ufu8[.]xyz sitemujxjlv2lmhh[.]xyz sitemuk3jcm1olr8[.]xyz sitemuk3jpe |
| domain | sitemujxjlv2lmhh.xyz | 9idqe01[.]xyz sitemujw1uspghl1[.]xyz sitemujwcvm5ufu8[.]xyz sitemujxjlv2lmhh[.]xyz sitemuk3jcm1olr8[.]xyz sitemuk3jpe1eph7[.]xyz sitemuk3z1h |
| domain | sitemuk3jcm1olr8.xyz | uspghl1[.]xyz sitemujwcvm5ufu8[.]xyz sitemujxjlv2lmhh[.]xyz sitemuk3jcm1olr8[.]xyz sitemuk3jpe1eph7[.]xyz sitemuk3z1hh2tvn[.]xyz sitemuk3zjr |
| domain | sitemuk3jpe1eph7.xyz | vm5ufu8[.]xyz sitemujxjlv2lmhh[.]xyz sitemuk3jcm1olr8[.]xyz sitemuk3jpe1eph7[.]xyz sitemuk3z1hh2tvn[.]xyz sitemuk3zjrr2ufy[.]xyz sitemuk3zu5 |
| domain | sitemuk3z1hh2tvn.xyz | lv2lmhh[.]xyz sitemuk3jcm1olr8[.]xyz sitemuk3jpe1eph7[.]xyz sitemuk3z1hh2tvn[.]xyz sitemuk3zjrr2ufy[.]xyz sitemuk3zu5776gi[.]xyz sitemuk6zd2 |
| domain | sitemuk3zjrr2ufy.xyz | cm1olr8[.]xyz sitemuk3jpe1eph7[.]xyz sitemuk3z1hh2tvn[.]xyz sitemuk3zjrr2ufy[.]xyz sitemuk3zu5776gi[.]xyz sitemuk6zd201nsw[.]xyz sitemuk7f31 |
| domain | sitemuk3zu5776gi.xyz | pe1eph7[.]xyz sitemuk3z1hh2tvn[.]xyz sitemuk3zjrr2ufy[.]xyz sitemuk3zu5776gi[.]xyz sitemuk6zd201nsw[.]xyz sitemuk7f31386dx[.]xyz sitemuk7fi1 |
| domain | sitemuk6zd201nsw.xyz | 1hh2tvn[.]xyz sitemuk3zjrr2ufy[.]xyz sitemuk3zu5776gi[.]xyz sitemuk6zd201nsw[.]xyz sitemuk7f31386dx[.]xyz sitemuk7fi1dcrp4[.]xyz sitemuk7fvn |
| domain | sitemuk7f31386dx.xyz | jrr2ufy[.]xyz sitemuk3zu5776gi[.]xyz sitemuk6zd201nsw[.]xyz sitemuk7f31386dx[.]xyz sitemuk7fi1dcrp4[.]xyz sitemuk7fvnvihra[.]xyz sitemuk7xby |
| domain | sitemuk7fi1dcrp4.xyz | u5776gi[.]xyz sitemuk6zd201nsw[.]xyz sitemuk7f31386dx[.]xyz sitemuk7fi1dcrp4[.]xyz sitemuk7fvnvihra[.]xyz sitemuk7xbyszpzj[.]xyz sitemuk7y43 |
| domain | sitemuk7fvnvihra.xyz | d201nsw[.]xyz sitemuk7f31386dx[.]xyz sitemuk7fi1dcrp4[.]xyz sitemuk7fvnvihra[.]xyz sitemuk7xbyszpzj[.]xyz sitemuk7y434m4om[.]xyz sitemuk7yi5 |
| domain | sitemuk7xbyszpzj.xyz | 31386dx[.]xyz sitemuk7fi1dcrp4[.]xyz sitemuk7fvnvihra[.]xyz sitemuk7xbyszpzj[.]xyz sitemuk7y434m4om[.]xyz sitemuk7yi5eqn74[.]xyz sitemuk7ys6 |
| domain | sitemuk7y434m4om.xyz | i1dcrp4[.]xyz sitemuk7fvnvihra[.]xyz sitemuk7xbyszpzj[.]xyz sitemuk7y434m4om[.]xyz sitemuk7yi5eqn74[.]xyz sitemuk7ys6db9qj[.]xyz sitemuk9ayi |
| domain | sitemuk7yi5eqn74.xyz | vnvihra[.]xyz sitemuk7xbyszpzj[.]xyz sitemuk7y434m4om[.]xyz sitemuk7yi5eqn74[.]xyz sitemuk7ys6db9qj[.]xyz sitemuk9ayiwadjz[.]xyz sitemuk9c4o |
| domain | sitemuk7ys6db9qj.xyz | byszpzj[.]xyz sitemuk7y434m4om[.]xyz sitemuk7yi5eqn74[.]xyz sitemuk7ys6db9qj[.]xyz sitemuk9ayiwadjz[.]xyz sitemuk9c4oppeco[.]xyz sitemukh5aw |
| domain | sitemuk9ayiwadjz.xyz | 434m4om[.]xyz sitemuk7yi5eqn74[.]xyz sitemuk7ys6db9qj[.]xyz sitemuk9ayiwadjz[.]xyz sitemuk9c4oppeco[.]xyz sitemukh5awm67rj[.]xyz sitemukpy2h |
| domain | sitemuk9c4oppeco.xyz | i5eqn74[.]xyz sitemuk7ys6db9qj[.]xyz sitemuk9ayiwadjz[.]xyz sitemuk9c4oppeco[.]xyz sitemukh5awm67rj[.]xyz sitemukpy2hpmpwv[.]xyz sitemukrod1 |
| domain | sitemukh5awm67rj.xyz | s6db9qj[.]xyz sitemuk9ayiwadjz[.]xyz sitemuk9c4oppeco[.]xyz sitemukh5awm67rj[.]xyz sitemukpy2hpmpwv[.]xyz sitemukrod1am6ez[.]xyz sitemukvxv7 |
| domain | sitemukpy2hpmpwv.xyz | yiwadjz[.]xyz sitemuk9c4oppeco[.]xyz sitemukh5awm67rj[.]xyz sitemukpy2hpmpwv[.]xyz sitemukrod1am6ez[.]xyz sitemukvxv7j5hmv[.]xyz sitemukvy7w |
| domain | sitemukrod1am6ez.xyz | 4oppeco[.]xyz sitemukh5awm67rj[.]xyz sitemukpy2hpmpwv[.]xyz sitemukrod1am6ez[.]xyz sitemukvxv7j5hmv[.]xyz sitemukvy7wudsqb[.]xyz sitemukww7i |
| domain | sitemukvxv7j5hmv.xyz | awm67rj[.]xyz sitemukpy2hpmpwv[.]xyz sitemukrod1am6ez[.]xyz sitemukvxv7j5hmv[.]xyz sitemukvy7wudsqb[.]xyz sitemukww7ivnaji[.]xyz sitemukwxih |
| domain | sitemukvy7wudsqb.xyz | 2hpmpwv[.]xyz sitemukrod1am6ez[.]xyz sitemukvxv7j5hmv[.]xyz sitemukvy7wudsqb[.]xyz sitemukww7ivnaji[.]xyz sitemukwxih8302f[.]xyz sitemul94tc |
| domain | sitemukww7ivnaji.xyz | d1am6ez[.]xyz sitemukvxv7j5hmv[.]xyz sitemukvy7wudsqb[.]xyz sitemukww7ivnaji[.]xyz sitemukwxih8302f[.]xyz sitemul94tcv4l80[.]xyz sitemul95f1 |
| domain | sitemukwxih8302f.xyz | v7j5hmv[.]xyz sitemukvy7wudsqb[.]xyz sitemukww7ivnaji[.]xyz sitemukwxih8302f[.]xyz sitemul94tcv4l80[.]xyz sitemul95f18sowo[.]xyz sitemul95px |
| domain | sitemul94tcv4l80.xyz | 7wudsqb[.]xyz sitemukww7ivnaji[.]xyz sitemukwxih8302f[.]xyz sitemul94tcv4l80[.]xyz sitemul95f18sowo[.]xyz sitemul95pxqgmm8[.]xyz sitemulaay8 |
| domain | sitemul95f18sowo.xyz | 7ivnaji[.]xyz sitemukwxih8302f[.]xyz sitemul94tcv4l80[.]xyz sitemul95f18sowo[.]xyz sitemul95pxqgmm8[.]xyz sitemulaay8dbm66[.]xyz sitemulaucn |
| domain | sitemul95pxqgmm8.xyz | ih8302f[.]xyz sitemul94tcv4l80[.]xyz sitemul95f18sowo[.]xyz sitemul95pxqgmm8[.]xyz sitemulaay8dbm66[.]xyz sitemulaucnbmnrd[.]xyz sitemulffos |
| domain | sitemulaay8dbm66.xyz | tcv4l80[.]xyz sitemul95f18sowo[.]xyz sitemul95pxqgmm8[.]xyz sitemulaay8dbm66[.]xyz sitemulaucnbmnrd[.]xyz sitemulffos1qryn[.]xyz sitemuli8pd |
| domain | sitemulaucnbmnrd.xyz | f18sowo[.]xyz sitemul95pxqgmm8[.]xyz sitemulaay8dbm66[.]xyz sitemulaucnbmnrd[.]xyz sitemulffos1qryn[.]xyz sitemuli8pd7qi9z[.]xyz sitemulpmt6 |
| domain | sitemulffos1qryn.xyz | pxqgmm8[.]xyz sitemulaay8dbm66[.]xyz sitemulaucnbmnrd[.]xyz sitemulffos1qryn[.]xyz sitemuli8pd7qi9z[.]xyz sitemulpmt6if530[.]xyz sitemulpnff |
| domain | sitemuli8pd7qi9z.xyz | y8dbm66[.]xyz sitemulaucnbmnrd[.]xyz sitemulffos1qryn[.]xyz sitemuli8pd7qi9z[.]xyz sitemulpmt6if530[.]xyz sitemulpnff7964j[.]xyz sitemulpo7j |
| domain | sitemulpmt6if530.xyz | cnbmnrd[.]xyz sitemulffos1qryn[.]xyz sitemuli8pd7qi9z[.]xyz sitemulpmt6if530[.]xyz sitemulpnff7964j[.]xyz sitemulpo7jkntfz[.]xyz sitemulr9d1 |
| domain | sitemulpnff7964j.xyz | os1qryn[.]xyz sitemuli8pd7qi9z[.]xyz sitemulpmt6if530[.]xyz sitemulpnff7964j[.]xyz sitemulpo7jkntfz[.]xyz sitemulr9d1dg77r[.]xyz sitemuls00q |
| domain | sitemulpo7jkntfz.xyz | pd7qi9z[.]xyz sitemulpmt6if530[.]xyz sitemulpnff7964j[.]xyz sitemulpo7jkntfz[.]xyz sitemulr9d1dg77r[.]xyz sitemuls00qrsh0k[.]xyz sitemulszq4 |
| domain | sitemulr9d1dg77r.xyz | t6if530[.]xyz sitemulpnff7964j[.]xyz sitemulpo7jkntfz[.]xyz sitemulr9d1dg77r[.]xyz sitemuls00qrsh0k[.]xyz sitemulszq4rm2yn[.]xyz About the a |
| domain | sitemuls00qrsh0k.xyz | ff7964j[.]xyz sitemulpo7jkntfz[.]xyz sitemulr9d1dg77r[.]xyz sitemuls00qrsh0k[.]xyz sitemulszq4rm2yn[.]xyz About the author Stefan Dasic Sr. |
| domain | sitemulszq4rm2yn.xyz | 7jkntfz[.]xyz sitemulr9d1dg77r[.]xyz sitemuls00qrsh0k[.]xyz sitemulszq4rm2yn[.]xyz About the author Stefan Dasic Sr. Malware Research Engine |
From the original article
5 min read at malwarebytes.com
More than 70 fake crypto sites promise extra rewards for casting a vote, then prompt visitors to connect their wallets.
By @malwarebytes · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.