Earlier, I published an article exposing scammers who create fake websites pretending to host token listing votes for CoinMarketCap (you can read it via link ). For a while, this vector seemed to go dormant. However, just a few days ago, I detected a resurgence of this campaign, wrapped in a slightly updated design.

In this article, we will examine:

1. The mechanics behind the “Listing Vote” and “Moonshot Vote” scam schemes.
2. How scammers promote these fake campaigns on Twitter / X to lure victims.
3. An overview of the phishing websites.
4. A technical breakdown of the scammers’ sloppy, telltale code.
5. How to protect yourself and what to do if you have already fallen into the trap.
6. Actionable steps we can take together (a complete reporting guide with templates, abuse contacts, and links).

The scheme operates as follows:

Mass bot campaigns: Scammers deploy bot networks on Twitter / X to publish automated posts claiming that a specific token is up for a listing vote. Typically, they target trending tokens with active community promotion whose real development teams have not yet secured an official CoinMarketCap (CMC) listing.
A typical scam post looks like this:

The scammers’ strategy relies on community trust: if a crypto project has thousands of active supporters, chances are at least a few will jump at the opportunity to vote for an asset they believe in.

The phishing site is styled to mimic CoinMarketCap (or Moonshot, in the case of the “Top 100 Moonshot Companies” variant). The technical reason behind this cloning is explained below.

• Deceptive signing prompt: When the victim clicks the “Vote” button, a modal appears stating: Gasless voting via signed message — wallet not charged, prompting the user to connect their Web3 wallet.

• ·Wallet draining: As soon as the victim connects their wallet and approves the request, automated scripts immediately siphon all available assets.

And just like that, the wallet is drained.

Scammers rely heavily on Twitter / X to distribute these campaigns. According to conservative estimates, between 100 and 150 automated bot accounts actively circulate links to the fake voting portals at any given time. As soon as platforms suspend these accounts, new ones appear to take their place.

You can easily locate these posts by searching queries such as "CoinMarketCap listing vote" directly on Twitter / X.
Here is an example of a scam post promoting the fake CoinMarketCap listing vote:

The same infrastructure is also adapted for the “Top 100 Moonshot Companies Vote” campaign:

While the copy in these posts remains nearly identical with slight variations, the scammers constantly rotate their domain names to stay ahead of automated blocklists.

Because security vendors and registrars frequently blacklist these portals, the attackers maintain a high turnover of domains.

For the CoinMarketCap lure, observed domains include https://supportsvote.forum, https://listandvoting.xyz, and various others. The operators also exploit cloud hosting and application deployment platforms like Vercel (e.g., https://marketsupportingvotes.vercel.app).

The landing page entry point appears as follows:

The fraudulent site pulls the official CoinMarketCap favicon:

The visitor is then routed to a dedicated voting page for a specific token. The URL structure combines the phishing domain with the target token’s genuine smart contract address, automatically fetched via the DexScreener API (explained in Section 4):

The scammers attempt to replicate CoinMarketCap’s official layout and design language:

However, the execution reveals sloppy development: interactive elements like dropdown navigation menus are completely non-functional.

To maintain an illusion of legitimacy, all auxiliary navigation links redirect back to the genuine coinmarketcap.com.
Clicking the “Vote…” button triggers a popup assuring the user that the vote is free of charge:

This statement is technically misleading: while you do not pay a network transaction fee, the signature grants the drainer full access to steal your balance.

The site then presents the wallet connection modal. Once connected and signed, the drainer sweeps the wallet.
The same underlying framework powers the Moonshot campaign:

It uses an identical flow, prompting for wallet connection under the guise of voting:

While the frontend templates differ slightly, both variants rely on the same drainer infrastructure.

4.1. Contract Address in the URL
The code shows: ^{[window.MVL_CONTRACT=“0x46d7b18f7c0a946298ce7ae400df5384bf5addef”;]}

Next, it passes into ^{rawContract → loadTokenData() → a request to DexScreener}. This is the bait token’s address, which the page uses to pull the real token name, logo, price, and chart to look legitimate. This address is authentic and has no relation to the skimmers.

However, ^cd94d33c in the path ^/go-cd94d33c is—judging by its format (8 hex characters)—a campaign identifier or an affiliate/distributor ID. The code comments also mention another route format: /home/<CA>.

4.2. How Wallets Are Connected
Let’s look at the buttons: [ Log In ] [ ]

And the class assignment function: ^{[ const chainClass = CHAIN.addrFormat === ‘base58’ ? ‘k2jklv-4t’ : ‘k16qxt-vv’;[‘btnVoteOpen’, ‘btnVote’, ‘connectBtn’].forEach(id => { el.classList.remove(‘k2jklv-4t’, ‘k16qxt-vv’); el.classList.add(chainClass);}); ]}

What this implies: - The ^openModal() function is not defined in this HTML. It is absent from all inline scripts and is loaded externally from ^{/assets/index.js}.
This means both the “Log In” and “Vote” buttons trigger code that does not exist in the baseline markup. - These classes are hooks for an off-the-shelf drainer (a drainer, or crypto drainer, is a type of malware designed to automatically empty crypto wallets, allowing attackers to transfer all or the most valuable assets to their own addresses).

- The combination of evm-connect, cnnctAprBtn, connectAndClaim, along with obfuscated classes ^{k16qxt-vv (for EVM) and k2jklv-4t} (for Solana), represents a classic Drainer-as-a-Service (DaaS) architecture (DaaS is a cybercrime business model where developers create and distribute ready-made tools for stealing cryptocurrency via smart contracts, turning phishing into an industrialized process where participants perform specialized roles).

- The affiliate operator buys a subscription, receives a compiled JS bundle, and gets instructions to “attach these classes to your buttons.” The operator did not write the drainer code and generally has no idea how it works under the hood. The obfuscated class names are usually generated per client or per build, allowing researchers to track the drainer across threat databases.

- Deconstructing the telltale class names: ^{cnnctAprBtn = connect + approve button; connectAndClaim = connect and “claim”}. The Apr prefix directly indicates an approve-based theft scheme.

- The WalletConnect projectId is absent from the HTML. If used, it is embedded inside the bundle (a bundle is a package of resources that the browser downloads and processes to display a webpage, which may include HTML, CSS, JavaScript, images, fonts, and other files). The recipient addresses are stored there as well—they do not appear in the markup at all.

4.3. Social Engineering Mechanics: The Core Deception
Let’s break down what the victim is actually led to sign.

The key hook: ^{[ Gasless voting via signed message — wallet not charged ]}

This statement is repeated inside the modal in a dedicated highlighted container with a green checkmark: ^{[ Gasless voting via signed message — wallet not charged. ]}

This is the core of their social engineering. The phrasing is technically not a lie: signing an off-chain message does not consume gas and is not broadcast as an on-chain transaction. However, ^{signTypedData} using a Permit or Permit2 structure grants permission to transfer the victim’s tokens without requiring a separate on-chain approve transaction. When signing this, the wallet interface does not display a warning saying “you are sending funds”—instead, it shows a confusing set of technical parameters. Because the victim was preconditioned to believe the signature is safe since the “wallet is not charged,” they sign it. That is the entire trick.

Notice the timer built into the confirmation button: ^{[ let remaining = 3;btn.disabled = true;label.textContent = ‘Confirm Vote (’ + remaining + ‘)’; ]}

The “Confirm Vote” button is disabled for three seconds with a visible countdown. In code comments, this is framed as a safeguard for the user—”to prevent an impulsive click before reading the window.” In reality, it produces the opposite effect: a mandatory three-second wait forces the user to focus on the text in the modal—specifically the reassurance about “gasless” and “wallet not charged.” This increases signature conversion rates.

4.4. Fabricated Social Proof
All “live” activity on the page is generated purely on the client side without a single backend server request.
The vote counter is a deterministic hash derived from the token address: ^{[ function votesFromAddr(addr) { if (!addr) return 18847; return 18500 + (hashStr(addr) % 1001);} ]}

It is designed cleverly: the calculated value always falls into the 18,500–19,500 range against a hardcoded threshold of 20,000. As a result, the progress bar consistently shows around 94%—conveying urgency by implying that the project is just short of the goal and your vote is decisive. Refreshing the page does not change the number because it relies on a hash rather than a random generator, making it look like authentic server-backed data.

The “recent votes” feed is generated locally according to the active network’s address format: ^{[ function genShortAddr() { const isSol = CHAIN.addrFormat === ‘base58’; const chars = isSol ? BASE58_CHARS : HEX_CHARS; …} ] [ function scheduleNextVote() { const delay = 6000 + Math.random() * 16000; // 6–22 s ]}

A new fake vote appears every 6–22 seconds, featuring randomized, properly formatted addresses and random “HOLDER” badges. In addition, there is a static countdown timer set to “4 days 8 hours 42 minutes” and a hardcoded CertiK badge: ^{[CertiK Verified]}

The tokenomics breakdown in the chart is also hardcoded (55/25/12/8) across all tokens. The token age “13d” is hardcoded as well, and “Vote Rank #2” is purely static text.

Another calculated element is the yellow warning banner: ^{[ This token is not verified by CoinMarketCap… Please DYOR. To get verified, Vote for Listing. ]}

A warning about an unverified token acts as a trust anchor: “the site is honest because it warns me.” Simultaneously, it nudges the user toward the target action. It is also possible that the scammer has very basic coding skills and was simply unable to remove this banner, as it copies the original CoinMarketCap notice: "^{...is not verified by CoinMarketCap. The logo and social links are from third-party sources. Please DYOR}".

4.5. Operator Footprints
Note that this is only the portion of evidence that can be shared publicly. In reality, the operator left substantial forensic footprints both in the markup and inside index.js, which have been forwarded to appropriate threat response channels.

Publicly disclosable technical evidence includes:
1. Russian-language developer comments left behind in production code:
^{[ // window.MVL_CONTRACT впечатывает воркер, когда контракт пришёл из пути// (/home/): search тогда пуст, а сам сайт лежит прямо на домене без iframe. ]
[ // Документ живёт внутри iframe ротации, поэтому window.location — это адрес// Pages-таргета, а не сайта: строить от него canonical и баннер нельзя.// ПРИ СМЕНЕ ОСНОВНОГО ДОМЕНА правится здесь и в og/canonical в . ]
[ // ВАЖНО: узла может не быть. Воркер в site-режиме переписывает своим// серверным SEO и теряет при этом id из этой разметки… исключение рвало// загрузку токена целиком… (2026-08-06).// SEO — косметика, данные токена — суть; косметика не имеет права ронять суть. ]}

These three snippets expose nearly the entire backend setup: Cloudflare Workers (the worker modifies the <head> and injects the contract address) + Cloudflare Pages (“Pages target”), two operation modes (site-mode and iframe-mode), domain rotation via iframe as a defense against blocklists, and an active development date of August 6, 2026 (or 2024 formatted/typed ahead). The final comment even reflects the developer’s mindset regarding SEO versus functional token loading.

4.6. Associated Campaign Domains
While inspecting the code on ^{votelisting.digital}, all Open Graph tags pointed to a different domain: [ ]

^{listandvotes.forum} represents either a previous/fallback domain or the active primary domain configured in the worker. As indicated by the comment “WHEN CHANGING THE MAIN DOMAIN update here”, rotating domains is standard procedure for this operation. As mentioned earlier, the scammers cycle through numerous domains, and more will follow.

4.7. Internal Project Name: MVL

The recurring prefix ^{__MVL_CONTRACT__} points to an internal naming convention (likely standing for Multi Vote Listing). This serves as a valuable threat intelligence marker for tracking this developer and their scam product across darknet markets, specialized forums, and services. We have already executed this tracking with actionable findings, though details remain confidential for now.

4.8. Broken Head Structure
The ^<style> tag is closed twice (^{</style></style>}), and the updateMeta function references around a dozen element IDs (metaDesc, ogTitle, canonicalUrl, etc.) that do not exist anywhere in the delivered HTML because the worker stripped them during rewrite. This confirms that the ^<head> is assembled on the server separately from the document body.

4.9. CMC Assets Scraped with Original IDs
Examining the file names: ^{chain-eth-1027.png, chain-bnb-1839.png, chain-sol-5426.png}. The numbers ^{1027, 1839, and 5426} are the internal coin IDs on CoinMarketCap for Ethereum, BNB, and Solana. The CMC logo is embedded as inline SVG, and the favicon is hardcoded directly from their domain: [ ]

This constitutes direct trademark infringement, providing immediate legal grounds for takedown complaints beyond general phishing reports.

4.10. Robinhood Chain Support

The network configuration contains a recent network with chain ID ⁴⁶⁶³ (Arbitrum Orbit L2) along with fallback handling for its public RPC: [ ^{const RH_RPC = “;} ]

The developers implemented a custom ERC-20 state reader querying directly via ^eth_call with ABI string decoding. This is not a default out-of-the-box template—it is manual customization for a very recent network, signaling an actively maintained project rather than abandoned legacy code.

4.11. Extracted Payloads and Artifacts
The main files retrieved for in-depth analysis include:
- Core Drainer Module: ^{https://votelisting.digital/assets/index.js?v=74c29f64} (A Vite-bundled ES module containing openModal(), connection flows, recipient address handling, and signing logic; build version hash: 74c29f64).
- Dynamic OG Image Generator (Worker Endpoints): - ^{https://votelisting.digital/og-image?contract=0x46d7b18f7c0a946298ce7ae400df5384bf5addef - https://listandvotes.forum/og-image?contract=0x46d7b18f7c0a946298ce7ae400df5384bf5addef}
- Supporting Assets: ^{/css2.css, /assets/chain-eth-1027.png, /assets/chain-bnb-1839.png, /assets/chain-base.png, /assets/chain-sol-5426.png, /assets/chain-40670.png}.
- Noticeably, ^css2.css is a locally hosted copy of Google Fonts CSS (originally ^{fonts.googleapis.com/css2}). Self-hosting the fonts ensures the phishing site avoids outbound requests to Google infrastructure and bypasses external blocking.

Additional indicators identified (despite layers of obfuscation over minification) that are reserved from full public disclosure include: EVM target addresses, Permit schemas, the WalletConnect projectId (32 hex characters), Telegram API hooks (^telegram.org used to notify operators of new victims), and a loader address associated with the C2 configuration (^{0x1AC7d768E37B147c993dE943D704c4e92d7861A1 on BSC via eth_call}).
The primary destination of stolen funds typically resides within secondary payloads or downstream Permit2/spender contracts.

Assessing the Scope of Compromise
If you signed a transaction or message (Approve, Permit, or SetApprovalForAll), you granted permission for an external contract to spend your ERC-20 tokens or NFTs. Take immediate action:

Step 1: Create a Clean Wallet
If you already maintain a secure, isolated secondary wallet, skip to Step 2.
1. Install a Web3 wallet (Rabby, MetaMask, Trust Wallet) on an uncontaminated device or fresh browser profile.
2. Generate a new recovery seed phrase. Never import a compromised seed phrase.
3. Store the seed phrase physically on paper. Avoid cloud storage, screenshots, or local text files.

Step 2: Evacuate Valuable Assets
If your wallet permissions were compromised, asset transfer takes priority over revoking permissions:
1. Open the compromised wallet.
2. Transfer remaining assets to the clean address in order of priority: stablecoins, native gas tokens (ETH, BNB, MATIC), high-value ERC-20 tokens, and NFTs.
3. Retain a minimal amount of native gas tokens to fund allowance revocations.
4. Review all active EVM networks (Ethereum, BNB Chain, Polygon, Arbitrum, Base, Optimism).

Note: If an automated sweeper bot has compromised your private key directly, manually transferring gas tokens will result in instant theft. In such scenarios, specialized tools (such as Flashbots bundles) are required.

Step 3: Revoke Token Approvals via Revoke.cash
If your private key remains secure and the compromise was limited to an on-chain allowance or off-chain Permit:
1. Navigate directly to revoke.cash (manually type the domain to avoid search engine phishing clones).
2. Connect the affected address.
3. Switch through each connected network.
4. Identify suspicious authorizations—particularly unlimited approvals granted to unrecognized smart contracts around the time of the incident.
5. Click Revoke on suspicious entries and confirm the transaction in your wallet.
6. Check the Signatures / Permits tab to revoke off-chain Permit and Permit2 allowances.

Alternative tools: Rabby Wallet’s native Approval Manager or the Token Approvals tool on Etherscan/BscScan.

Step 4: Understanding the Limits of Revocation

• Revoking permissions stops future unauthorized transfers; it cannot recover previously stolen funds.
• If your seed phrase or private key was exposed, revoking permissions is insufficient. The compromised account must be abandoned completely.

Step 5: Post-Incident Cleanup

1. Run a malware scan across your system.
2. Update critical credentials and ensure 2FA is active on all exchange and email accounts.
3. Disconnect active dApp sessions inside your wallet settings.
4. Use dedicated hardware wallets for long-term asset storage and separate throwaway “hot wallets” for interacting with unfamiliar Web3 websites.

Quick Checklist

1. Create a clean wallet with a new seed phrase ✅
2. Transfer remaining assets to the safe wallet ✅
3. Visit revoke.cash → Inspect all networks → Revoke suspicious Approvals & Permits ✅
4. Run system scans and update credentials ✅
5. Retire the compromised address ✅

Reporting individual bot accounts or single domains in isolation rarely stops organized operations. However, coordinating abuse reports across security vendors, infrastructure providers, and blocklists actively disrupts their infrastructure.

6.1. Public Warning on Social Media
When encountering scam posts on Twitter / X, leave a warning reply to alert other users:

_{"BEWARE OF SCAM! This is a scammer trying to steal your money—do not connect your wallet!"}

6.2. Send the set of complaints (for your convenience, the text of the complaint is provided below).
INSTEAD OF DOMAINS VOTELISTING.DIGITAL , LISTANDVOTES.FORUM, SPECIFY THE DOMAIN CURRENTLY BEING USED BY THE SCAMMER.

• Chainabuse

A collaborative threat intelligence database utilized by exchanges and blockchain intelligence firms.

<sub>[ Subject: Cryptocurrency phishing and wallet-draining scam involving two domains I am reporting two domains that appear to operate the same cryptocurrency phishing scam:

The websites are disguised as voting or listing platforms. Visitors are encouraged to connect a cryptocurrency wallet and may be prompted to approve token permissions, sign malicious messages, or send transactions. The reported behavior is designed to gain unauthorized control over wallet assets and drain the connected wallet. The links are reportedly distributed through X/Twitter. Please investigate both domains, record them in your abuse database, and share the indicators with relevant exchanges, wallet providers, blockchain analytics companies, and security teams. Evidence available:
• Website URLs: and
• Screenshots and screen recordings: [attach files]
• X/Twitter posts or accounts distributing the links: [insert URLs]
• Blockchain network and wallet addresses involved: [insert details]
• Transaction hashes: [insert hashes]
• Date and time observed, including time zone: [insert details] I have not connected my wallet or signed any transaction with these sites. ]</sub>

• ScamSniffer & Web3 Antivirus

Submitting indicators to Web3 security providers enables real-time browser extension warnings for other users.

<sub>[ Subject: Request to blocklist cryptocurrency phishing domains Please investigate and blocklist the following suspected wallet-draining phishing domains:

Both domains present themselves as voting or cryptocurrency listing websites. Users are encouraged to connect a wallet and may be induced to approve malicious token permissions, sign malicious messages, or authorize transactions that can result in the loss of all assets in the wallet. The domains are being promoted through X/Twitter. Requested action:
1. Analyze both domains and their associated contracts, scripts, and wallet addresses.
2. Add the domains and any related indicators to your phishing and scam blocklists.
3. Share the indicators with wallet providers and security partners. Evidence:
• Distribution posts/accounts: [insert URLs]
• Contract or recipient addresses: [insert addresses]
• Transaction hashes: [insert hashes]
• Screenshots or recordings: [attach files]
• First observed date and time: [insert details] ]</sub>

• MetaMask eth-phishing-detect (GitHub)

Submit an issue or pull request to MetaMask’s open-source detection repository.
_{[ Title: Report suspected wallet-draining phishing domains: votelisting.digital and listandvotes.forum Malicious domains
Description These domains appear to operate a cryptocurrency phishing scam disguised as a voting or listing website. The sites encourage users to connect a Web3 wallet and may request malicious token approvals, signatures, or transactions that can result in unauthorized transfer of wallet assets. The domains are reportedly distributed through X/Twitter. Evidence
• Distribution URLs: [insert X/Twitter URLs]
• Suspicious contract or recipient addresses: [insert addresses]
• Transaction hashes: [insert hashes]
• Screenshots or recordings: [attach or link]
• First observed: [date, time, time zone] Please investigate both domains and add them to the appropriate phishing-warning lists if confirmed. ]}

• Cloudflare Abuse Operations

Because the campaign relies on Cloudflare Workers and Pages, submitting reports via Cloudflare’s abuse form directly targets their hosting layer.

<sub>[ Subject: Phishing and cryptocurrency wallet-draining websites hosted using Cloudflare services I am reporting two domains that appear to be used for a cryptocurrency phishing and wallet-draining scam:

The websites are disguised as voting or cryptocurrency listing platforms. They encourage visitors to connect a Web3 wallet and may induce users to approve malicious token permissions, sign malicious messages, or authorize transactions. The apparent purpose is to obtain unauthorized access to cryptocurrency and token assets. The domains appear to use Cloudflare infrastructure, potentially including Workers and/or Pages. Please investigate the domains, associated Cloudflare services, account(s), Workers, Pages projects, and origin infrastructure. Requested action:
• Preserve relevant logs and account information in accordance with your policies.
• Suspend or disable the abusive resources if your investigation confirms the activity.
• Prevent continued distribution of the phishing content.
• Notify the relevant registrar or hosting provider where appropriate. Evidence:
• Reported URLs:
• X/Twitter distribution URLs: [insert URLs]
• Screenshots/video: [attach files]
• Related wallet addresses and transaction hashes: [insert details]
• Dates and times observed, including time zone: [insert details] I am reporting suspected abuse in good faith and request urgent review because visitors may lose cryptocurrency after interacting with these websites. ]</sub>

• Antivirus Vendors (e.g., Kaspersky)

Submit unflagged domains to security labs for automated reputation updates.

<sub>[ Subject: Suspected cryptocurrency phishing domains not detected by Kaspersky Please review the following domains for suspected cryptocurrency phishing and wallet-draining behavior:

The websites are disguised as voting or cryptocurrency listing services. They encourage users to connect a Web3 wallet and may request malicious token approvals, signatures, or transactions capable of transferring assets from the victim’s wallet. The domains are reportedly promoted through X/Twitter. These URLs may not currently trigger a warning in Kaspersky products, so I request that they be analyzed and added to the relevant malicious or phishing URL databases if confirmed. Evidence:
• Screenshots or recordings: [attach files]
• X/Twitter distribution URLs: [insert URLs]
• Suspicious wallet or contract addresses: [insert addresses]
• Transaction hashes: [insert hashes]
• Product and version tested: [insert details]
• Date and time tested, including time zone: [insert details] ]</sub>

• Google Safe Browsing

Submitting reports triggers phishing warnings across Chrome, Firefox, and Safari.

<sub>[ These domains appear to be cryptocurrency phishing websites:

The sites are disguised as voting or cryptocurrency listing platforms. They encourage visitors to connect a Web3 wallet and may request malicious approvals, signatures, or transactions that can result in unauthorized transfer of cryptocurrency and tokens. The links are reportedly distributed through X/Twitter. Please investigate and add the domains to Google Safe Browsing warnings if they are confirmed to be malicious. Evidence:
• X/Twitter URLs: [insert URLs]
• Screenshots or recordings: [attach or link]
• Wallet or contract addresses: [insert addresses]
• Transaction hashes: [insert hashes]
• Date and time observed: [insert details] ]</sub>

• Domain Registrars

Identify the sponsoring registrar via WHOIS/RDAP (ICANN Lookup, CentralNic, or Verisign) and submit takedown requests directly to their abuse contacts:
https://who.is/
https://www.whois.com/whois
https://lookup.icann.org/en
Look for the Registrar, Registrar Abuse Contact Email, and Registrar Abuse Contact Phone fields.

<sub>[ Subject: Urgent abuse report: phishing and cryptocurrency wallet-draining domain votelisting.digital I am reporting the domain:

The domain appears to host a cryptocurrency phishing and wallet-draining website disguised as a voting or cryptocurrency listing platform. Visitors are encouraged to connect a Web3 wallet and may be induced to approve malicious token permissions, sign malicious messages, or authorize transactions that can transfer assets from their wallets without informed consent. The domain is reportedly distributed through X/Twitter and may be used to defraud cryptocurrency users. Please investigate the domain and take appropriate action under your abuse and acceptable-use policies, including suspension where warranted. Please also preserve relevant registration and abuse records and refer the matter to the hosting or infrastructure provider if necessary. Evidence:
• Website:
• Distribution posts/accounts: [insert X/Twitter URLs]
• Screenshots or recordings: [attach files]
• Wallet or contract addresses: [insert addresses]
• Transaction hashes: [insert hashes]
• Date and time observed: [insert details] This report is submitted in good faith to prevent further victimization. ]</sub>

• Twitter / X Reporting

To report distribution bots and posts:
- Individual Post: Open post menu (...) → Select Report post.
- Account: Open profile menu (...) → Select Report account.
Post Report Text:
_{[ This post promotes suspected cryptocurrency phishing websites:
The websites are disguised as voting or cryptocurrency listing services and encourage users to connect a Web3 wallet. They may request malicious approvals, signatures, or transactions that can drain cryptocurrency and token assets from the connected wallet. Please review the post, the linked domains, and the account distributing them for cryptocurrency fraud, phishing, and malicious links. Pos
URL: [insert exact X/Twitter post URL]
Account URL: [insert account URL]
Additional evidence: [insert screenshots, related posts, wallet addresses, or transaction hashes] ]}

Account Report Text:
_{[ This account appears to distribute links to suspected cryptocurrency phishing websites:
promoted websites are disguised as voting or cryptocurrency listing platforms. Their purpose appears to be persuading users to connect a Web3 wallet and approve malicious actions that may drain cryptocurrency and tokens.
Please investigate this account and its posts for cryptocurrency fraud, phishing, impersonation, and malicious-link distribution.
Account URL: [insert account URL]
Example post URLs: [insert all relevant post URLs] ]}

Stay safe out there. Through coordinated analysis, community reporting, and proactive mitigation, we can dismantle scam infrastructure and keep the Web3 ecosystem secure.

#CoinMarketCap #CoinMarketCap-Listing-Vote #CryptoScam #Fraud #Web3Security #CyberSecurity