voting-lifi[.]xyz

PhishDestroy identifies voting-lifi.xyz as an active generic phishing domain impersonating a legitimate voting portal, likely targeting users with fake Li-Fi (Light Fidelity) voting schemes. The domain leverages urgency around modern voting technologies to trick victims into entering sensitive credentials or cryptocurrency wallet access. There are no indications of a specific brand impersonation or advanced drainer kit integration, but the generic nature suggests opportunistic credential harvesting with potential for fund theft via simulated wallet connectivity interfaces.

This domain was flagged with 0 detections out of 95 VirusTotal engines, suggesting it has yet to be widely analyzed or blocklisted. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to IP 172.67.135.222, and was created on April 21, 2026. The SSL certificate is issued by Let's Encrypt, which is commonly abused in phishing campaigns due to its low validation overhead and broad browser trust. The domain has not yet been flagged by Google Safe Browsing (GSB) and currently appears on zero public blocklists (as of report generation), indicating it remains in early deployment stages.

The current status of voting-lifi.xyz is active and under investigation with no confirmed takedown efforts initiated. Immediate action is recommended: users and organizations should block the domain at DNS and network levels, monitor for related infrastructure (e.g., additional domains or IPs), and report to threat intelligence platforms such as VirusTotal, URLScan, and abuse contacts of the hosting provider. While the immediate risk appears contained due to low detection rates and recent registration, the absence of proactive blocking increases exposure to unaware users. Risk status remains 'under_investigation' pending further behavioral analysis and correlation with known fraud campaigns.