votes-tokenworks[.]com

The domain votes-tokenworks.com was registered on July 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is currently active and resolves to the IP address 104.21.43.159, which is hosted on Cloudflare infrastructure as indicated by the authoritative nameservers kip.ns.cloudflare.com and meera.ns.cloudflare.com. The domain appears on a single security blocklist, specifically PhishDestroy, confirming that at least one anti‑phishing service has flagged it as malicious.

VirusTotal records show that the domain has been scanned by 91 antivirus and URL‑reputation vendors; none of the scanners have raised a detection, but the absence of a detection does not constitute proof of benign intent. No public information about the site’s SSL certificate, HTTP response codes, page title, or any observed payloads is available, leaving the exact content and tactics employed by the site unverified. The limited visibility means that while the domain is known to be used for credential‑harvesting attempts, the specific phishing kit, targeted brands, or victim demographics have not been identified.

Defenders should treat votes-tokenworks.com as a high‑confidence indicator of compromise (IOC) and block traffic to the domain at the network perimeter and DNS filtering layers. Security teams should also monitor for related domains registered with the same registrar or resolving to the same IP address, and incorporate the domain into threat‑intel feeds used by endpoint detection and response (EDR) solutions. Continuous re‑evaluation is advised, as additional evidence such as page content or malicious payloads may emerge from future sandbox analyses or community reporting.