vote-giza[.]pages[.]dev

Analysis indicates that vote-giza.pages.dev is an active credential‑phishing infrastructure. The domain was registered on 24 November 2025 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.45 located in the United States (AS13335). TLS termination is performed by Google Trust Services under the WE1 certificate, and HTTP responses return status 200 with HSTS enabled. Detected client‑side libraries include crypto‑js and cdnjs, and the site supports HTTP/3. Nameservers are ashton.ns.cloudflare.com and nancy.ns.cloudflare.com. The page title reported by crawlers is "Giza". VirusTotal scans show 2 of 91 security vendors flagging the domain, and it is listed on the PhishDestroy and ScamSniffer blocklists. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. No additional content analysis is available, so the exact phishing page layout remains unverified. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and add the host to internal threat feeds. Continuous re‑scanning is advised to capture any changes to the payload or hosting configuration.