Fake xStocks, Pendle, and other sites bait crypto users with rewards votes
A large-scale phishing operation has deployed 70 fraudulent websites impersonating legitimate cryptocurrency projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites closely replicate authentic platforms and lure visitors with offers to vote on rewards distribution dates in exchange for a 1.25x boost. Upon clicking the vote button, users encounter a wallet connection prompt that ultimately leads to malicious authorization requests designed to drain cryptocurrency tokens. The targeted projects were strategically selected based on recent token launches, airdrops, or active rewards programs, making the phishing attempts appear credible to community members. All malicious domains follow the pattern 'sitemu' followed by random characters on the .xyz domain, suggesting a coordinated campaign using shared infrastructure and phishing kits.
AI Analysis
Technical Summary
This phishing campaign involves 70 fraudulent websites impersonating legitimate crypto projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites lure users with fake voting on rewards distribution dates, offering a 1.25x boost. Upon voting, users are prompted to connect their wallets, which triggers malicious authorization requests designed to steal tokens. The campaign exploits recent token launches and rewards programs to increase credibility. All malicious domains follow a 'sitemu' plus random characters pattern on the .xyz TLD, suggesting shared infrastructure and coordinated phishing kits.
Potential Impact
Users who interact with these fraudulent sites risk unauthorized access to their cryptocurrency wallets, potentially resulting in token theft. The campaign targets users of specific crypto projects with active rewards or recent token launches, increasing the likelihood of successful deception. The wallet connection prompts lead to malicious authorization requests that can drain users' tokens.
Mitigation Recommendations
No official patch or fix applies as this is a phishing campaign. Users should avoid interacting with suspicious websites, especially those with domains matching the 'sitemu' pattern on .xyz. Community members should verify URLs carefully and only use official project websites or trusted sources. Educating users about phishing tactics and wallet connection risks is recommended.
Indicators of Compromise
- domain: sitemuife3h91vjj.xyz
- domain: sitemujoqrmsm0et.xyz
- domain: sitemujrfn7witew.xyz
- domain: sitemujtcvh5q9fj.xyz
- domain: sitemujtdkvy6c7n.xyz
- domain: sitemujumvtmjaf1.xyz
- domain: sitemujuncdlpnng.xyz
- domain: sitemujuno47vpud.xyz
- domain: sitemuk7y434m4om.xyz
- domain: sitemuk7yi5eqn74.xyz
- domain: sitemuk7ys6db9qj.xyz
- domain: sitemuk9ayiwadjz.xyz
- domain: sitemuk9c4oppeco.xyz
- domain: sitemukrod1am6ez.xyz
- domain: sitemukvxv7j5hmv.xyz
- domain: sitemukh5awm67rj.xyz
- domain: sitemukww7ivnaji.xyz
- domain: sitemukwxih8302f.xyz
- domain: sitemul95pxqgmm8.xyz
- domain: sitemulaucnbmnrd.xyz
- domain: sitemuli8pd7qi9z.xyz
- domain: sitemulpmt6if530.xyz
- domain: sitemulpo7jkntfz.xyz
- domain: sitemuls00qrsh0k.xyz
- domain: sitemulszq4rm2yn.xyz
- domain: sitemufl06qs0r4o.xyz
- domain: sitemui6m6bbj1bd.xyz
- domain: sitemui8go6g99bb.xyz
- domain: sitemuicitd4jrtr.xyz
- domain: sitemuidkr38kji0.xyz
- domain: sitemuidlij5urd0.xyz
- domain: sitemuif3pa5k4eh.xyz
- domain: sitemuioeefbyh3i.xyz
- domain: sitemuioi7005ekb.xyz
- domain: sitemuizkhpdbjnv.xyz
- domain: sitemuj1xencnin8.xyz
- domain: sitemuj7lzbasipw.xyz
- domain: sitemujbcz1nas1x.xyz
- domain: sitemujdi54aitrf.xyz
- domain: sitemujejvp4tp0x.xyz
- domain: sitemujffobdhxgj.xyz
- domain: sitemuji07m137aw.xyz
- domain: sitemujsm7brhwh0.xyz
- domain: sitemujtd8ingh2b.xyz
- domain: sitemujufht1ntj4.xyz
- domain: sitemujufs1975v4.xyz
- domain: sitemujug76lkyke.xyz
- domain: sitemujunzgjapds.xyz
- domain: sitemujw19idqe01.xyz
- domain: sitemujw1uspghl1.xyz
- domain: sitemujwcvm5ufu8.xyz
- domain: sitemujxjlv2lmhh.xyz
- domain: sitemuk3jcm1olr8.xyz
- domain: sitemuk3jpe1eph7.xyz
- domain: sitemuk3z1hh2tvn.xyz
- domain: sitemuk3zjrr2ufy.xyz
- domain: sitemuk3zu5776gi.xyz
- domain: sitemuk6zd201nsw.xyz
- domain: sitemuk7f31386dx.xyz
- domain: sitemuk7fi1dcrp4.xyz
- domain: sitemuk7fvnvihra.xyz
- domain: sitemuk7xbyszpzj.xyz
- domain: sitemukpy2hpmpwv.xyz
- domain: sitemukvy7wudsqb.xyz
- domain: sitemul94tcv4l80.xyz
- domain: sitemul95f18sowo.xyz
- domain: sitemulaay8dbm66.xyz
- domain: sitemulffos1qryn.xyz
- domain: sitemulpnff7964j.xyz
- domain: sitemulr9d1dg77r.xyz
Fake xStocks, Pendle, and other sites bait crypto users with rewards votes
Description
A large-scale phishing operation has deployed 70 fraudulent websites impersonating legitimate cryptocurrency projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites closely replicate authentic platforms and lure visitors with offers to vote on rewards distribution dates in exchange for a 1.25x boost. Upon clicking the vote button, users encounter a wallet connection prompt that ultimately leads to malicious authorization requests designed to drain cryptocurrency tokens. The targeted projects were strategically selected based on recent token launches, airdrops, or active rewards programs, making the phishing attempts appear credible to community members. All malicious domains follow the pattern 'sitemu' followed by random characters on the .xyz domain, suggesting a coordinated campaign using shared infrastructure and phishing kits.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This phishing campaign involves 70 fraudulent websites impersonating legitimate crypto projects including xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, and Firelight. The fake sites lure users with fake voting on rewards distribution dates, offering a 1.25x boost. Upon voting, users are prompted to connect their wallets, which triggers malicious authorization requests designed to steal tokens. The campaign exploits recent token launches and rewards programs to increase credibility. All malicious domains follow a 'sitemu' plus random characters pattern on the .xyz TLD, suggesting shared infrastructure and coordinated phishing kits.
Potential Impact
Users who interact with these fraudulent sites risk unauthorized access to their cryptocurrency wallets, potentially resulting in token theft. The campaign targets users of specific crypto projects with active rewards or recent token launches, increasing the likelihood of successful deception. The wallet connection prompts lead to malicious authorization requests that can drain users' tokens.
Defensive Guidance
No official patch or fix applies as this is a phishing campaign. Users should avoid interacting with suspicious websites, especially those with domains matching the 'sitemu' pattern on .xyz. Community members should verify URLs carefully and only use official project websites or trusted sources. Educating users about phishing tactics and wallet connection risks is recommended.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes"]
- Pulse Id
- 6abec7fc11f84dc2a20573a9
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainsitemuife3h91vjj.xyz | — | |
domainsitemujoqrmsm0et.xyz | — | |
domainsitemujrfn7witew.xyz | — | |
domainsitemujtcvh5q9fj.xyz | — | |
domainsitemujtdkvy6c7n.xyz | — | |
domainsitemujumvtmjaf1.xyz | — | |
domainsitemujuncdlpnng.xyz | — | |
domainsitemujuno47vpud.xyz | — | |
domainsitemuk7y434m4om.xyz | — | |
domainsitemuk7yi5eqn74.xyz | — | |
domainsitemuk7ys6db9qj.xyz | — | |
domainsitemuk9ayiwadjz.xyz | — | |
domainsitemuk9c4oppeco.xyz | — | |
domainsitemukrod1am6ez.xyz | — | |
domainsitemukvxv7j5hmv.xyz | — | |
domainsitemukh5awm67rj.xyz | — | |
domainsitemukww7ivnaji.xyz | — | |
domainsitemukwxih8302f.xyz | — | |
domainsitemul95pxqgmm8.xyz | — | |
domainsitemulaucnbmnrd.xyz | — | |
domainsitemuli8pd7qi9z.xyz | — | |
domainsitemulpmt6if530.xyz | — | |
domainsitemulpo7jkntfz.xyz | — | |
domainsitemuls00qrsh0k.xyz | — | |
domainsitemulszq4rm2yn.xyz | — | |
domainsitemufl06qs0r4o.xyz | — | |
domainsitemui6m6bbj1bd.xyz | — | |
domainsitemui8go6g99bb.xyz | — | |
domainsitemuicitd4jrtr.xyz | — | |
domainsitemuidkr38kji0.xyz | — | |
domainsitemuidlij5urd0.xyz | — | |
domainsitemuif3pa5k4eh.xyz | — | |
domainsitemuioeefbyh3i.xyz | — | |
domainsitemuioi7005ekb.xyz | — | |
domainsitemuizkhpdbjnv.xyz | — | |
domainsitemuj1xencnin8.xyz | — | |
domainsitemuj7lzbasipw.xyz | — | |
domainsitemujbcz1nas1x.xyz | — | |
domainsitemujdi54aitrf.xyz | — | |
domainsitemujejvp4tp0x.xyz | — | |
domainsitemujffobdhxgj.xyz | — | |
domainsitemuji07m137aw.xyz | — | |
domainsitemujsm7brhwh0.xyz | — | |
domainsitemujtd8ingh2b.xyz | — | |
domainsitemujufht1ntj4.xyz | — | |
domainsitemujufs1975v4.xyz | — | |
domainsitemujug76lkyke.xyz | — | |
domainsitemujunzgjapds.xyz | — | |
domainsitemujw19idqe01.xyz | — | |
domainsitemujw1uspghl1.xyz | — | |
domainsitemujwcvm5ufu8.xyz | — | |
domainsitemujxjlv2lmhh.xyz | — | |
domainsitemuk3jcm1olr8.xyz | — | |
domainsitemuk3jpe1eph7.xyz | — | |
domainsitemuk3z1hh2tvn.xyz | — | |
domainsitemuk3zjrr2ufy.xyz | — | |
domainsitemuk3zu5776gi.xyz | — | |
domainsitemuk6zd201nsw.xyz | — | |
domainsitemuk7f31386dx.xyz | — | |
domainsitemuk7fi1dcrp4.xyz | — | |
domainsitemuk7fvnvihra.xyz | — | |
domainsitemuk7xbyszpzj.xyz | — | |
domainsitemukpy2hpmpwv.xyz | — | |
domainsitemukvy7wudsqb.xyz | — | |
domainsitemul94tcv4l80.xyz | — | |
domainsitemul95f18sowo.xyz | — | |
domainsitemulaay8dbm66.xyz | — | |
domainsitemulffos1qryn.xyz | — | |
domainsitemulpnff7964j.xyz | — | |
domainsitemulr9d1dg77r.xyz | — |
Threat ID: 6abf6144a43b0b3b898aa6c4
Added to database: 10/02/2026, 07:46:12 UTC
Last enriched: 10/02/2026, 08:16:21 UTC
Last updated: 10/03/2026, 02:52:54 UTC
Views: 21
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.