# PhishDestroy threat dossier — votings-virtual.pages.dev ================================================================ Fetched: 2026-07-23 14:48:38 UTC Canonical: https://phishdestroy.io/domain/votings-virtual.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Forcepoint ThreatSeeker, Gridinsoft Public blocklists: listed on 4 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.44.177 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare Pages HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-16 Status: INVALID chain Fingerprint: fabd03dd0ae04dab0439f4e198936d7a93f4dc791e5b58df49f76817a805d8e4 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-07-19 12:38:29 UTC (by PhishDestroy tracker) Last verified: 2026-07-23 16:20:27 UTC Current status: ACTIVE / observable ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-21 20:23:41 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] votings-virtual.pages.dev Fake Voting Portal Alert The domain votings-virtual.pages.dev is currently active and hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.177, which is geolocated to Canada and owned by Cloudflare, Inc. Registration information shows the site was provisioned through Cloudflare Pages, a typical serverless hosting service, and the TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS configuration. An HTTP GET request returns a 200 OK status, confirming that the web service is reachable and serving content. VirusTotal analysis reports that 3 of 91 security vendors have flagged the domain, suggesting that a minority of scanners have identified malicious characteristics. The domain appears on four security blocklists, specifically PhishDestroy, MetaMask, ScamSniffer, and SEAL, demonstrating that multiple independent threat intelligence feeds have recognized it as a threat. The risk rating assigned is high, and the threat type is categorized as generic phishing, implying that the site is likely used to harvest credentials or personal data without targeting a specific brand. No additional details such as page title, brand impersonation, or malware kit have been disclosed, leaving the exact content and attack vector unverified. Defenders should prioritize blocking the domain at perimeter firewalls, DNS resolvers, and proxy filters, and ensure that endpoint detection platforms incorporate the listed blocklist identifiers. Continuous monitoring of DNS queries for the IP 172.66.44.177 and associated Cloudflare ASN is recommended to detect any pivoting activity. Organizations should also review authentication logs for attempts to submit credentials to unknown voting portals and enforce multi-factor authentication to mitigate credential theft. Given the active status and high risk, ongoing intelligence gathering and periodic re‑scanning of the domain are advised to capture any evolution in its malicious behavior. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 017c25036871c85440c46f629a3c59f5 TLS cert SHA-256: fabd03dd0ae04dab0439f4e198936d7a93f4dc791e5b58df49f76817a805d8e4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/votings-virtual.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=votings-virtual.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,898 domains (58,547 alive under monitoring, 128,729 confirmed takedowns/dead). Site: https://phishdestroy.io