one-vote[.]app

This domain, one-vote.app, was registered on April 4, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently flagged as an active phishing threat. Analysis indicates the domain resolves to 104.21.65.103, a Cloudflare IP address located in Canada, with nameservers clara.ns.cloudflare.com and wells.ns.cloudflare.com. The use of Cloudflare infrastructure is consistent with phishing campaigns attempting to obscure origin and evade takedowns. A Let's Encrypt SSL certificate (serial E8) is present, which is commonly exploited to lend false legitimacy to phishing pages. As of July 12, 2026, the domain returns an HTTP 403 status, suggesting either a placeholder page, access restrictions, or a recently disabled phishing kit. Despite the lack of visible content, the domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse, indicating prior malicious activity. VirusTotal reports two out of ninety-five security vendors flagging the domain, though the absence of widespread detection does not preclude its use in targeted attacks. The registration date, combined with the use of Cloudflare and a low detection rate, suggests an attempt to operate below the threshold of automated defenses. Defenders should treat this domain as high-risk, particularly for credential harvesting or social engineering campaigns. Monitoring for changes in HTTP status or newly hosted content is recommended, as the domain remains active and may resume malicious operations. Network-level blocking or sinkholing of 104.21.65.103 should be considered to mitigate potential exposure.