vote-raac[.]xyz

PhishDestroy identifies vote-raac.xyz as an active credential-harvesting domain posing as a fake voting portal, designed to trick users into submitting sensitive information under false pretenses. vote-raac.xyz is a confirmed malicious domain registered through PDR Ltd. d/b/a PublicDomainRegistry.com on March 26, 2026. Despite being hosted on IP 172.67.149.135 and secured with a Let's Encrypt SSL certificate, it was flagged by only 1 out of 95 VirusTotal security vendors at time of analysis. This low detection rate suggests either a new or highly evasive threat. While the domain lacks a known brand impersonation at this time, its name strongly implies involvement in fraudulent voting-related activities, a common tactic in phishing campaigns targeting election participation or civic engagement. This domain poses an elevated risk due to its active status, plausible naming, and SSL certificate, which lends false legitimacy. The low VirusTotal detection ratio (1/95) and recent creation date indicate that security infrastructure has not yet widely recognized this threat. Furthermore, the use of a legitimate registrar and free SSL provider demonstrates how attackers exploit widely trusted services to bypass security filters. Users who visited vote-raac.xyz should immediately cease any interaction with the site and avoid entering any personal, financial, or login credentials. If credentials were entered, change passwords immediately and enable multi-factor authentication on all related accounts. Report the domain to your IT team or security provider and consider running a malware scan on any device used to access the site. Do not return to the domain under any circumstances. If this site claims affiliation with a legitimate organization, contact that organization directly using verified contact information to confirm legitimacy. Always verify website URLs carefully—look for misspellings, unusual domains, or lack of HTTPS indicators.