“Vote Now for a 1.25x Rewards Boost” — the Ballot Box Is a Wallet Drainer (2026)

Never connect a wallet there. Malwarebytes counted 70 lookalike sites impersonating xStocks from Kraken, Pendle, Zama, and other real projects — all pitching a “vote on the rewards date” for a 1.25x boost, and every Vote button opens the same Connect Wallet window instead of a ballot. Connecting exposes your address and holdings; the follow-up “sign” or “approve,” framed as confirming your vote, hands permission to move your tokens — and blockchain transfers don't reverse. Verify any vote on the project's official site, typed yourself, and reject any signature you can't read.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — October 6, 2026 →

Why you’re seeing this now

Malwarebytes counted 70 lookalike sites impersonating xStocks from Kraken, Pendle, Zama, Kinetiq, Yield Basis, Firelight, and smaller names like Umia, Keeta, and NetNet — copies so close that one carried the real project's own announcement. The pitch is deliberately small: vote on the rewards date, collect a 1.25x boost. The Vote button doesn't open a ballot — it opens the same Connect Wallet window on every site, listing WalletConnect, MetaMask, Trust Wallet, OKX, Binance, Bitget, and Rabby among 28-plus options. Connecting alone exposes your address and holdings; the kill shot is the follow-up request to “sign” or “approve,” framed as confirming your vote. A malicious approval hands permission to move your tokens — and blockchain transfers don't reverse. It's one kit: every domain is sitemu followed by random letters on .xyz, the text reused word for word, right down to writing the boost as “1,25x” with a comma. Targets were chosen because their communities expect claims — Umia's auction ended September 2, Pendle launched on Robinhood Chain September 4. Verify any vote on the project's official site, typed yourself; reject any signature you can't read.

Five red flags — any one is enough

A “vote” or “rewards” page reached by link, ad, or DM — not an address you typed.

A modest, believable perk — a 1.25x boost — engineered to feel routine.

The Vote button opens a Connect Wallet window instead of a ballot.

A signature or transaction request mentioning approvals, permits, or transfers — voting never needs to spend your tokens.

Random-letter .xyz domains, countdown timers, and “unclaimed tokens will be burned” deadlines.

Your next three moves

Verify through a channel you open yourself — type the project's official site into your browser and confirm the vote or claim there, or on its verified social accounts. A real campaign is announced at the source; these copies live on random sitemu*.xyz domains reached by link, ad, or DM.

Refuse the signature: voting never needs to spend your tokens. Reject any request mentioning approvals, permits, or transfers that you can't read — a malicious approval hands permission to move your tokens, and blockchain transfers don't reverse. Disconnecting later does not revoke approvals.

Report the site at reportfraud.ftc.gov and to the FBI at ic3.gov — and if you already approved something, revoke it through your wallet's approval manager or a trusted approval checker. Paste the site's link into the $2 instant check for a 0–100 scam risk score before anyone in your community connects.

Is connecting a wallet the same as giving permission to spend?

No — connecting shares your address. The danger is the next step: signing or approving a transaction. Reject anything you can't read, and remember disconnecting later does not revoke approvals — use your wallet's approval manager or a token-approval checker.

The site looks exactly like the real project — how do I check?

Ignore the design and check the address. Genuine votes and claims are announced on the project's official site and social accounts; these copies live on random sitemu*.xyz domains.

I already approved a transaction — what now?

Revoke it through your wallet's approval-management feature or a trusted approval checker, move remaining funds to a fresh wallet if your recovery phrase may be exposed, and report at ic3.gov.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.