list-voting[.]xyz

Analysis of list-voting.xyz shows a domain created on 28 December 2025 and registered through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers gabriel.ns.cloudflare.com and surina.ns.cloudflare.com resolve the domain to IP 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented, indicating the site operated without HTTPS. The page title observed during the brief capture was “Cierpliwości…”, and the activity has been classified as a banking phishing campaign.

The infrastructure received a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis recorded three detections out of ninety‑three scanned engines, confirming that multiple security vendors identified malicious behavior. The current HTTP status is offline, suggesting the site has been taken down or is otherwise inaccessible at the time of observation.

Defenders encountering traffic to list‑voting.xyz should block the domain at perimeter filters, update DNS deny lists, and monitor for any residual connections to the associated Cloudflare IP address. Ongoing vigilance is advised because the hosting provider may be reused for future malicious campaigns, and the lack of TLS does not preclude the reuse of the same infrastructure for other phishing vectors. Continuous re‑evaluation of threat intelligence feeds for new detections related to this domain or its IP range is recommended.