fogo-vote[.]com

Analysis of fogo-vote.com, created on 21 February 2026 and currently active, shows a clear phishing posture. The site presents a single page whose title is "Just a moment..." and returns HTTP 403, indicating that legitimate browsers are denied access while automated checks may be bypassed. The domain resolves to 104.21.79.52, an address owned by AS13335 Cloudflare, Inc., placing the hosting infrastructure within the United States. Cloudflare services are confirmed by the presence of Cloudflare Browser Insights, HTTP/3 support, and the authoritative nameservers demi.ns.cloudflare.com and harlan.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 designation, providing a legitimate‑looking TLS handshake that can lend false confidence to unsuspecting victims.

Detection data show that 2 of 93 security vendors on VirusTotal have flagged the domain, reinforcing the suspicion of malicious use. The site is listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy filtering service. Additional reputation signals are poor: Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of legitimate activity. The registrar listed as NiceNIC International Group Co., Limited indicates a relatively open registration channel, which is common for short‑lived phishing infrastructure.

While the exact phishing campaign content cannot be confirmed without page content analysis, the observable indicators—short domain age, Cloudflare‑hosted IP, valid Google TLS certificate, low trust score, and vendor flags—are sufficient to classify the site as a high‑risk phishing vector. Defenders should immediately block fogo-vote.com and its resolving IP 104.21.79.52 at network perimeters, add the domain to internal blocklists, and monitor for any derivative subdomains that may be created under the same registrar.