zebec-vote[.]xyz

Analysis of zebec-vote.xyz shows a newly registered domain created on July 25 2026 by NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IPv4 address 192.162.199.139 and is served by the authoritative name servers coco.bunny.net and kiki.bunny.net. Independent threat‑intelligence services have added the host to three public blocklists, and it is currently blocked by PhishDestroy, MetaMask and SEAL, indicating that multiple sinks have observed malicious activity. VirusTotal reports five detections out of ninety‑one scanners, confirming that at least a subset of security products classify the site as malicious.

The risk rating assigned by the reporting system is high, and the domain remains active as of the report date, July 28 2026. Available evidence points to a generic phishing operation, but the specific lure or targeted brand has not been disclosed in the collected metadata. No information on TLS certificates, HTTP response codes, page titles, or content snapshots is presently available, so defenders cannot confirm the exact look‑and‑feel of the landing page. The short lifespan between registration and detection suggests the operators are employing rapid‑deployment tactics, often used to evade reputation buildup.

Defenders should proactively block zebec‑vote.xyz at the DNS resolver level and add its IP address 192.162.199.139 to network‑level deny lists. Email gateways should be configured to treat any messages containing this domain as malicious, and intrusion‑detection signatures that reference the observed nameservers (coco.bunny.net, kiki.bunny.net) may help catch related infrastructure. Continuous monitoring of the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED for new registrations with similar naming patterns is advisable, as is periodic re‑query of VirusTotal and blocklist feeds to capture any changes in detection status.