> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Fake xStocks, Pendle, and other sites bait crypto users with rewards votes - URL: https://f4n6.co.uk/security-feed/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes/ - Published: 2026-10-01T21:06:48.000Z - Updated: 2026-10-01T21:06:48.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Malwarebytes has identified 70 domains impersonating legitimate crypto projects, including xStocks (Kraken), Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, and NetNet, that present a fake "vote on the rewards date" prompt and route visitors into a wallet-connection flow. The domains follow a single naming pattern (`sitemu` plus random characters on `.xyz`), reuse identical templates across brands, and share one wallet-connection window, which points to a single operator or phishing kit rather than 70 independent campaigns. No CVSS score, CVE, or CISA KEV entry applies: this is a social-engineering and wallet-draining campaign, not a software vulnerability. The direct risk to EMEA financial services is limited to staff and clients who hold the impersonated tokens or use the named wallets, but the campaign is a live example of brand-impersonation infrastructure that can be repointed at any financial brand, and the wallet-approval mechanism it relies on is the same one used against institutional treasury wallets. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | No specific DORA/NIS2 article is directly engaged by this item | The campaign targets retail crypto holders through fake third-party websites. No ICT incident at a client, no third-party provider in the client's supply chain, and no reporting threshold is implicated by the source material. | None. Treat as threat intelligence for awareness and detection tuning, not as a reportable event. | The source does not describe an incident at any regulated entity, a compromised ICT third-party provider, or a supply-chain compromise. Mapping DORA Art. 17, 18, 19, 28, 29, 30 or NIS2 Art. 21(2)(d), 23 to this item would be a compliance-checkbox exercise with no operational consequence. If a client's own staff or treasury wallet is later drained through one of these domains, DORA Art. 17 and 19 and NIS2 Art. 23 become engaged at that point, and the incident-management and reporting clocks start then. ## 3\. Technical analysis & attack chain The campaign is a brand-impersonation and wallet-draining operation. The confirmed steps below are drawn from the Malwarebytes report; the operator's identity, hosting, and any downstream cash-out infrastructure are not described in the source. 1. A victim receives or finds a link to a domain matching the pattern `sitemu.xyz`. The source does not state the distribution channel (search, social, direct message, or paid placement). 2. The domain serves a page that copies the target project's logo, menus, and colours. The Firelight copy reproduces a real announcement about the protocol's deposit cap, which indicates the pages were copied from the live sites rather than rebuilt. 3. The page presents a rewards-vote offer. Most variants promise a 1.25x boost for voting on the rewards distribution date. Variants: the Pendle copy adds fake dates and a countdown, the Keeta copy promises points, and the NetNet copy skips the vote and warns that unclaimed tokens will be burned after 48 hours. 4. Clicking "Vote now" does not open a ballot. It opens a "Connect Wallet" window that is identical across all impersonated brands. The window lists WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, and Rabby, plus an option to browse more than 28 others. 5. Connecting a wallet shares the wallet address, which lets the site look up holdings. At this stage the site has no permission to spend tokens. 6. The source states that in wallet-draining scams the damage comes from the next request: a message-signing or transaction-approval prompt presented as confirmation of the action the visitor intended. A malicious approval or signature grants permission to move tokens without further confirmation. 7. Blockchain transactions are generally irreversible, so stolen funds are difficult to recover. **Shared-infrastructure evidence.** All 70 domains follow the `sitemu` \+ random string + `.xyz` pattern. Templates are reused across brands with near-identical wording, including the boost written as `1,25x` with a comma decimal separator, which is consistent with a European locale or a copied template. The wallet-connection window is identical across brands. The source assesses this as a shared operation or phishing kit; that assessment is single-sourced to Malwarebytes and is not corroborated by a second vendor in the material provided. **Target selection.** The source states the target list is not random. Zama ran a public token auction in January and its token began trading in February; Kinetiq launched its governance token with an airdrop to early users in November 2025; Umia's token auction ran from 29 August to 2 September; Firelight awards points to early depositors; Pendle launched on Robinhood Chain on 4 September. The lure is aimed at people who already hold the token or have used the protocol and would expect a distribution. **What the source does not provide.** No hosting provider, registrar, ASN, IP address, TLS certificate detail, JavaScript filename, wallet-drainer contract address, or threat-actor attribution is given. The report does not name a malware family, does not state whether the pages serve a drainer script or hand off to a third-party drainer service, and does not describe any post-connection exfiltration beyond the on-chain approval. Treat any attribution to a named group as unconfirmed; there is none in the source. ## 4\. Mitigation & containment ### P1 (within 24 hours) - Block the 70 `sitemu*.xyz` domains at the DNS resolver, secure web gateway, and endpoint web-protection layer. The full list is in §5\. Because the operator rotates domains on the same pattern, add a wildcard block for `sitemu*.xyz` rather than relying on the enumerated list alone. - Push an internal advisory to staff who hold the impersonated tokens (xStocks, Pendle, Zama, Kinetiq, Yield Basis, Firelight, Umia, Keeta, NetNet) or use the named wallets, stating that no legitimate rewards vote requires a wallet connection and that the `sitemu*.xyz` pattern is the giveaway. - If any corporate or treasury wallet has interacted with a `sitemu*.xyz` domain, treat the wallet as compromised. Revoke token approvals for the affected address using the wallet's approval-management interface, and move remaining assets to a new address with a fresh seed phrase. ### P2 (within 72 hours) - Add the `sitemu*.xyz` pattern and the wallet-connection behaviour to phishing-detection rules in the email gateway and browser-protection tooling. - Confirm that browser-protection or scam-blocking tooling is deployed and current on all endpoints that can reach the public internet. Malwarebytes Browser Guard is named in the source as blocking known phishing and scam sites; equivalent controls from other vendors serve the same purpose. - Brief client-facing teams so that any client reporting a suspicious rewards or airdrop link is routed to the fraud team rather than handled as a generic phishing query. ### P3 (within 7 days) - Add a standing control to the crypto-asset or digital-asset desk procedure: verify any rewards, vote, claim, or airdrop offer through the project's official channels before connecting a wallet. The source states this explicitly and it is the only control that defeats the lure regardless of domain rotation. - Review whether any client-facing communications reference the impersonated projects, and add a warning if so. ## 5\. Indicators of compromise All indicators below are domains from the Malwarebytes report. They are defanged for publication. The domain set is single-sourced to Malwarebytes; verify before enforcement. | type | value | confidence | source | | ------ | ------------------------ | ---------- | ------------ | | domain | sitemufl06qs0r4o\[.\]xyz | high | Malwarebytes | | domain | sitemui6m6bbj1bd\[.\]xyz | high | Malwarebytes | | domain | sitemui8go6g99bb\[.\]xyz | high | Malwarebytes | | domain | sitemuicitd4jrtr\[.\]xyz | high | Malwarebytes | | domain | sitemuidkr38kji0\[.\]xyz | high | Malwarebytes | | domain | sitemuidlij5urd0\[.\]xyz | high | Malwarebytes | | domain | sitemuif3pa5k4eh\[.\]xyz | high | Malwarebytes | | domain | sitemuife3h91vjj\[.\]xyz | high | Malwarebytes | | domain | sitemuioeefbyh3i\[.\]xyz | high | Malwarebytes | | domain | sitemuioi7005ekb\[.\]xyz | high | Malwarebytes | | domain | sitemuizkhpdbjnv\[.\]xyz | high | Malwarebytes | | domain | sitemuj1xencnin8\[.\]xyz | high | Malwarebytes | | domain | sitemuj7lzbasipw\[.\]xyz | high | Malwarebytes | | domain | sitemujbcz1nas1x\[.\]xyz | high | Malwarebytes | | domain | sitemujdi54aitrf\[.\]xyz | high | Malwarebytes | | domain | sitemujejvp4tp0x\[.\]xyz | high | Malwarebytes | | domain | sitemujffobdhxgj\[.\]xyz | high | Malwarebytes | | domain | sitemuji07m137aw\[.\]xyz | high | Malwarebytes | | domain | sitemujoqrmsm0et\[.\]xyz | high | Malwarebytes | | domain | sitemujrfn7witew\[.\]xyz | high | Malwarebytes | | domain | sitemujsm7brhwh0\[.\]xyz | high | Malwarebytes | | domain | sitemujtcvh5q9fj\[.\]xyz | high | Malwarebytes | | domain | sitemujtd8ingh2b\[.\]xyz | high | Malwarebytes | | domain | sitemujtdkvy6c7n\[.\]xyz | high | Malwarebytes | | domain | sitemujufht1ntj4\[.\]xyz | high | Malwarebytes | | domain | sitemujufs1975v4\[.\]xyz | high | Malwarebytes | | domain | sitemujug76lkyke\[.\]xyz | high | Malwarebytes | | domain | sitemujumvtmjaf1\[.\]xyz | high | Malwarebytes | | domain | sitemujuncdlpnng\[.\]xyz | high | Malwarebytes | | domain | sitemujuno47vpud\[.\]xyz | high | Malwarebytes | | domain | sitemujunzgjapds\[.\]xyz | high | Malwarebytes | | domain | sitemujw19idqe01\[.\]xyz | high | Malwarebytes | | domain | sitemujw1uspghl1\[.\]xyz | high | Malwarebytes | | domain | sitemujwcvm5ufu8\[.\]xyz | high | Malwarebytes | | domain | sitemujxjlv2lmhh\[.\]xyz | high | Malwarebytes | | domain | sitemuk3jcm1olr8\[.\]xyz | high | Malwarebytes | | domain | sitemuk3jpe1eph7\[.\]xyz | high | Malwarebytes | | domain | sitemuk3z1hh2tvn\[.\]xyz | high | Malwarebytes | | domain | sitemuk3zjrr2ufy\[.\]xyz | high | Malwarebytes | | domain | sitemuk3zu5776gi\[.\]xyz | high | Malwarebytes | | domain | sitemuk6zd201nsw\[.\]xyz | high | Malwarebytes | | domain | sitemuk7f31386dx\[.\]xyz | high | Malwarebytes | | domain | sitemuk7fi1dcrp4\[.\]xyz | high | Malwarebytes | | domain | sitemuk7fvnvihra\[.\]xyz | high | Malwarebytes | | domain | sitemuk7xbyszpzj\[.\]xyz | high | Malwarebytes | | domain | sitemuk7y434m4om\[.\]xyz | high | Malwarebytes | | domain | sitemuk7yi5eqn74\[.\]xyz | high | Malwarebytes | | domain | sitemuk7ys6db9qj\[.\]xyz | high | Malwarebytes | | domain | sitemuk9ayiwadjz\[.\]xyz | high | Malwarebytes | | domain | sitemuk9c4oppeco\[.\]xyz | high | Malwarebytes | | domain | sitemukh5awm67rj\[.\]xyz | high | Malwarebytes | | domain | sitemukpy2hpmpwv\[.\]xyz | high | Malwarebytes | | domain | sitemukrod1am6ez\[.\]xyz | high | Malwarebytes | | domain | sitemukvxv7j5hmv\[.\]xyz | high | Malwarebytes | | domain | sitemukvy7wudsqb\[.\]xyz | high | Malwarebytes | | domain | sitemukww7ivnaji\[.\]xyz | high | Malwarebytes | | domain | sitemukwxih8302f\[.\]xyz | high | Malwarebytes | | domain | sitemul94tcv4l80\[.\]xyz | high | Malwarebytes | | domain | sitemul95f18sowo\[.\]xyz | high | Malwarebytes | | domain | sitemul95pxqgmm8\[.\]xyz | high | Malwarebytes | | domain | sitemulaay8dbm66\[.\]xyz | high | Malwarebytes | | domain | sitemulaucnbmnrd\[.\]xyz | high | Malwarebytes | | domain | sitemulffos1qryn\[.\]xyz | high | Malwarebytes | | domain | sitemuli8pd7qi9z\[.\]xyz | high | Malwarebytes | | domain | sitemulpmt6if530\[.\]xyz | high | Malwarebytes | | domain | sitemulpnff7964j\[.\]xyz | high | Malwarebytes | | domain | sitemulpo7jkntfz\[.\]xyz | high | Malwarebytes | | domain | sitemulr9d1dg77r\[.\]xyz | high | Malwarebytes | | domain | sitemuls00qrsh0k\[.\]xyz | high | Malwarebytes | | domain | sitemulszq4rm2yn\[.\]xyz | high | Malwarebytes | ```iocs domain sitemufl06qs0r4o[.]xyz domain sitemui6m6bbj1bd[.]xyz domain sitemui8go6g99bb[.]xyz domain sitemuicitd4jrtr[.]xyz domain sitemuidkr38kji0[.]xyz domain sitemuidlij5urd0[.]xyz domain sitemuif3pa5k4eh[.]xyz domain sitemuife3h91vjj[.]xyz domain sitemuioeefbyh3i[.]xyz domain sitemuioi7005ekb[.]xyz domain sitemuizkhpdbjnv[.]xyz domain sitemuj1xencnin8[.]xyz domain sitemuj7lzbasipw[.]xyz domain sitemujbcz1nas1x[.]xyz domain sitemujdi54aitrf[.]xyz domain sitemujejvp4tp0x[.]xyz domain sitemujffobdhxgj[.]xyz domain sitemuji07m137aw[.]xyz domain sitemujoqrmsm0et[.]xyz domain sitemujrfn7witew[.]xyz domain sitemujsm7brhwh0[.]xyz domain sitemujtcvh5q9fj[.]xyz domain sitemujtd8ingh2b[.]xyz domain sitemujtdkvy6c7n[.]xyz domain sitemujufht1ntj4[.]xyz domain sitemujufs1975v4[.]xyz domain sitemujug76lkyke[.]xyz domain sitemujumvtmjaf1[.]xyz domain sitemujuncdlpnng[.]xyz domain sitemujuno47vpud[.]xyz domain sitemujunzgjapds[.]xyz domain sitemujw19idqe01[.]xyz domain sitemujw1uspghl1[.]xyz domain sitemujwcvm5ufu8[.]xyz domain sitemujxjlv2lmhh[.]xyz domain sitemuk3jcm1olr8[.]xyz domain sitemuk3jpe1eph7[.]xyz domain sitemuk3z1hh2tvn[.]xyz domain sitemuk3zjrr2ufy[.]xyz domain sitemuk3zu5776gi[.]xyz domain sitemuk6zd201nsw[.]xyz domain sitemuk7f31386dx[.]xyz domain sitemuk7fi1dcrp4[.]xyz domain sitemuk7fvnvihra[.]xyz domain sitemuk7xbyszpzj[.]xyz domain sitemuk7y434m4om[.]xyz domain sitemuk7yi5eqn74[.]xyz domain sitemuk7ys6db9qj[.]xyz domain sitemuk9ayiwadjz[.]xyz domain sitemuk9c4oppeco[.]xyz domain sitemukh5awm67rj[.]xyz domain sitemukpy2hpmpwv[.]xyz domain sitemukrod1am6ez[.]xyz domain sitemukvxv7j5hmv[.]xyz domain sitemukvy7wudsqb[.]xyz domain sitemukww7ivnaji[.]xyz domain sitemukwxih8302f[.]xyz domain sitemul94tcv4l80[.]xyz domain sitemul95f18sowo[.]xyz domain sitemul95pxqgmm8[.]xyz domain sitemulaay8dbm66[.]xyz domain sitemulaucnbmnrd[.]xyz domain sitemulffos1qryn[.]xyz domain sitemuli8pd7qi9z[.]xyz domain sitemulpmt6if530[.]xyz domain sitemulpnff7964j[.]xyz domain sitemulpo7jkntfz[.]xyz domain sitemulr9d1dg77r[.]xyz domain sitemuls00qrsh0k[.]xyz domain sitemulszq4rm2yn[.]xyz ``` ### Behavioural indicators The source describes behaviours rather than atomic host artefacts. These are the observables to hunt for. | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------ | ----------------------- | | DNS query for a sitemu\*.xyz domain | DNS resolver logs, secure web gateway, endpoint DNS telemetry | high | | Browser navigation to a .xyz page presenting a rewards vote with a "Connect Wallet" button | Web proxy logs, browser-protection telemetry | high | | Wallet-connection prompt listing WalletConnect, MetaMask, Trust Wallet, OKX Wallet, Binance Wallet, Bitget Wallet, Rabby | Endpoint browser telemetry, wallet extension logs | medium (single-sourced) | | Message-signing or token-approval request immediately following a wallet connection on a rewards or airdrop page | Wallet extension logs, on-chain approval events for the affected address | medium (single-sourced) | ## 6\. Detection The source provides no file hashes, no malware strings, and no host artefacts. The only machine-pivotable artefacts are the domains and the `sitemu*.xyz` naming pattern. A YARA rule is not appropriate here because there is no file content to match. The Sigma rule below targets DNS and proxy telemetry for the domain pattern. ```yaml title: DNS or proxy request to sitemu-pattern crypto phishing domains id: 8f3c2a91-4d7e-4b16-9a2c-1e5f7b0d3c48 status: experimental description: Detects DNS queries or HTTP proxy requests to domains matching the sitemu.xyz pattern used by the crypto rewards-vote phishing campaign reported by Malwarebytes on 2026-10-01. author: Adverse Trace date: 2026-10-01 references: - https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes logsource: category: dns detection: selection_dns: QueryName|re: '^sitemu[a-z0-9]+\.xyz$' selection_proxy: c-uri|re: '^https?://sitemu[a-z0-9]+\.xyz/' condition: selection_dns or selection_proxy fields: - QueryName - c-uri - Computer - User falsepositives: - None expected. The sitemu prefix on .xyz is not a known legitimate naming convention. level: high ``` For environments without DNS logging, the equivalent control is a web-proxy or secure-web-gateway rule matching the same regular expression against the request host. The wildcard block recommended in §4 covers the same ground at the resolver. ## 7\. Sources - Malwarebytes, "Fake xStocks, Pendle, and other sites bait crypto users with rewards votes", https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes, 2026-10-01. This advisory rests on a single vendor report. The domain list, the shared-infrastructure assessment, and the wallet-connection behaviour are all single-sourced to Malwarebytes. No second vendor, CERT, or law-enforcement source corroborates the campaign in the material provided. Verify the domain list against your own telemetry before enforcing a block, and treat the "single operation or phishing kit" assessment as an analyst judgement rather than a confirmed attribution. ## 8\. Adverse Trace position Adverse Trace assesses this as a moderate-severity, high-volume brand-impersonation campaign with no direct exposure to EMEA financial services infrastructure. There is no CVE, no CVSS score, and no CISA KEV entry, so it does not enter the vulnerability-management queue. The risk to clients is indirect: staff and clients who hold the impersonated tokens can be drained through a single wallet approval, and the same `sitemu*.xyz` template infrastructure can be repointed at a bank's brand with minimal effort. We will add the 70 domains and the `sitemu*.xyz` wildcard to our blocklist feed, monitor for new domains on the same pattern, and re-issue this advisory if a second source corroborates the campaign or if any domain is observed targeting a financial brand. Clients with a digital-asset desk should treat the wallet-approval verification step in §4 P3 as the control that matters, because domain rotation defeats any static blocklist. --- [Read the original source →](https://www.malwarebytes.com/blog/threat-intel/2026/10/fake-xstocks-pendle-and-other-sites-bait-crypto-users-with-rewards-votes?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*