derive-voting[.]xyz

This domain, derive-voting.xyz, is currently flagged as an active voter registration phishing site targeting election-related credentials and personal data. Analysis indicates the infrastructure is designed to impersonate legitimate voter registration portals, though no specific brand affiliation has been confirmed. The domain remains operational and poses a high risk to users seeking election services. Infrastructure analysis reveals derive-voting.xyz was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 25, 2026, an unusually future-dated registration that aligns with known phishing campaign patterns. The domain resolves to the IP address 188.114.97.3 and is presently listed on three distinct security blocklists. VirusTotal detection metrics show 4 of 95 security vendors have flagged this domain as malicious, while the absence of an SSL certificate further undermines its legitimacy. The domain's creation date, combined with its immediate appearance on threat intelligence feeds, suggests premeditated malicious intent. Current status confirms derive-voting.xyz remains active and accessible. Security teams are advised to implement immediate network-level blocking for the domain and its associated IP address. Organizations should update endpoint protection rules to include this indicator of compromise and monitor for any attempts to access derive-voting.xyz from internal networks. Users should be educated to recognize voter registration phishing attempts and verify all election-related communications through official government channels only.