vote-usdai[.]app

Analysis of vote-usdai.app shows a newly registered domain (created 22 Feb 2026) that has been actively used for phishing and is now offline. The domain is hosted on Cloudflare DNS (nameservers donald.ns.cloudflare.com and etta.ns.cloudflare.com) and resolves to the edge address 172.67.170.189, an IP owned by AS13335 Cloudflare, Inc. located in the United States. No SSL certificate is presented, and the only observable page title is "Just a moment...," which is typical of a Cloudflare challenge page and provides no additional content for assessment.

The domain appears on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple anti‑phishing services have flagged it as malicious. VirusTotal scans report that two of ninety‑five scanners flagged the domain, reinforcing the suspicion of malicious intent. While the exact phishing lure, target brand, or payload has not been captured, the combination of recent creation, lack of TLS, reliance on Cloudflare’s CDN, and inclusion on reputable blocklists establishes a high confidence that the site was employed for credential‑harvesting or similar fraudulent activity.

Defenders should add vote-usdai.app to DNS‑based blocklists, enforce sink‑hole routing for the resolved IP, and monitor for any re‑registration or alternative hosting that might revive the threat. Continuous re‑scanning of the domain, should it become active again, is advised to capture any evolving payloads or techniques.