# PhishDestroy threat dossier — vote-nestusd.xyz ================================================================ Fetched: 2026-07-11 09:52:04 UTC Canonical: https://phishdestroy.io/domain/vote-nestusd.xyz/ ## VERDICT ---------------------------------------------------------------- SUSPICIOUS — under active investigation Composite threat score: 39/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/95 security vendors flagged this domain Flagging vendors: alphaMountain.ai, CRDF, Gridinsoft, LevelBlue ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.67.218.19 ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com Nameservers: kayleigh.ns.cloudflare.com, piers.ns.cloudflare.com Registered: 2026-07-02 Expires: 2027-07-02 Page title: FASTPANEL ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-02 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-11 09:09:58 UTC (by PhishDestroy tracker) Last verified: 2026-07-11 10:30:19 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f5001-63cf-70eb-b9b0-7c2e7a3493be/ Wayback Machine: https://web.archive.org/web/*/vote-nestusd.xyz crt.sh CT logs: https://crt.sh/?q=%25.vote-nestusd.xyz Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=vote-nestusd.xyz AlienVault OTX: https://otx.alienvault.com/indicator/domain/vote-nestusd.xyz URLhaus: https://urlhaus.abuse.ch/host/vote-nestusd.xyz/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-11 09:41:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged as a high-risk phishing threat targeting individuals seeking voter registration or election-related services. Analysis indicates that vote-nestusd.xyz is designed to deceive users into submitting personal information, such as names, addresses, and identification details, under the guise of official voter registration or ballot access. The site may also attempt to distribute malicious payloads or harvest credentials for fraudulent purposes, including identity theft or unauthorized access to government systems. Infrastructure analysis reveals concrete evidence supporting this assessment. The domain was registered on July 02, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with newly created phishing domains. As of the latest scan, 4 out of 95 security vendors on VirusTotal have flagged vote-nestusd.xyz as malicious, a low but notable detection rate that often indicates early-stage or sophisticated phishing campaigns. The domain resolves to the IP address 104.21.24.84, which is part of Cloudflare’s network, a common tactic used by threat actors to obfuscate their true hosting infrastructure and evade detection. Additionally, the site employs HTTP/3 and Cloudflare Browser Insights, further masking its malicious intent behind legitimate-seeming technologies. If you or someone you know has visited vote-nestusd.xyz, immediate action is required to mitigate potential risks. First, do not enter any personal information or download any files from the site. If credentials were submitted, change passwords for all associated accounts, particularly those tied to government services, email, or financial platforms. Enable multi-factor authentication where available to add an extra layer of security. Monitor bank statements, credit reports, and online accounts for unauthorized activity, as phishing victims are often targeted for follow-up attacks. Report the domain to local election authorities or cybersecurity organizations to help prevent further exploitation. For technical users, consider running a malware scan on any device used to access the site, as phishing pages may deploy scripts or payloads to compromise systems. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/vote-nestusd.xyz/ JSON API: https://api.destroy.tools/v1/check?domain=vote-nestusd.xyz Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 177,282 domains (50,543 alive under monitoring, 126,601 confirmed takedowns/dead). Site: https://phishdestroy.io