app[.]standx-vote[.]com

Analysis of app.standx-vote.com shows a newly registered (19 Dec 2025) infrastructure that impersonates Discord for credential or seed harvesting. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare nameservers (brianna.ns.cloudflare.com, nitin.ns.cloudflare.com). DNS resolution points to 188.114.97.3, an IP owned by AS13335 Cloudflare, Inc., geolocated in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP, which is consistent with a low‑cost deployment.

The page title observed on the live site reads "StandX Perps - Yield‑Earning $DUSD Margin Trading", indicating a possible crypto‑related lure that may be combined with Discord brand impersonation. VirusTotal has recorded 2 detections out of 93 scanning engines, confirming that at least a couple of security vendors have identified malicious behavior. Independent blocklists PhishDestroy and ScamSniffer have already listed the domain, and the Gridinsoft trust score of 0 / 100 reinforces the high‑risk assessment.

The domain is currently offline, but its presence on multiple blocklists and the low trust score suggest it was actively used before takedown. Defenders should add app.standx-vote.com to DNS and URL filtering policies, monitor traffic to its Cloudflare IP for any residual activity, and enforce strict credential handling for Discord accounts. Continuous monitoring of the registrar and the associated IP range is advised to catch any re‑registration attempts or parallel campaigns, as the infrastructure components (Cloudflare edge, public registrar) are readily reusable by threat actors.