enso[.]vote

Analysis of the domain enso.vote (unique seed 7ed17b) indicates that the site was hosting a generic phishing campaign before being taken offline on July 24, 2026. The domain resolves to the IP address 104.21.53.123, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. DNS resolution uses the Cloudflare name servers kianchau.ns.cloudflare.com and meilani.ns.cloudflare.com, and the registration was performed through Cloudflare, Inc., suggesting the attacker leveraged the provider’s free or low‑cost services to conceal identity. The web page returned the title “Nur einen Moment…”, and no TLS certificate was presented, indicating that the site operated without HTTPS protection. Threat‑intelligence sources show limited but consistent detection.

The domain appears on a single security blocklist and has been recorded in one AlienVault OTX pulse. Gridinsoft assigned a trust score of 0 out of 100, and the anti‑phishing service PhishDestroy listed the domain as blocked. VirusTotal scanned the site and three of ninety‑five security vendors flagged it, reinforcing the suspicion of malicious activity despite the low detection count. Because the site is currently offline, active mitigation is limited to preventing future re‑use of the same infrastructure.

Defenders should block the IP address 104.21.53.123 at network perimeters, add enso.vote to host‑based denial lists, and monitor for new domains that resolve to the same Cloudflare name servers or share the same registration pattern. Continuous observation of Cloudflare‑hosted domains flagged by the same blocklists and OTX pulse is recommended. At present, no additional payload details, credential‑harvesting forms, or target brand information are available, so the exact phishing vector remains uncertain. Ongoing correlation with endpoint telemetry and URL filtering logs will help determine whether any compromised users attempted to access the domain before it was taken down.