vote-molten[.]app

The domain vote-molten.app was registered on March 03, 2026 through NiceNIC International Group Co., Limited and is currently observed as active. Its risk rating is high, and it is identified as a generic phishing infrastructure. The site returns an HTTP 403 response and presents a page title of “Just a moment…”, indicating a possible challenge page but no further content has been publicly disclosed. Infrastructure analysis shows the domain resolves to the IP address 104.21.83.18, hosted within the Cloudflare network (AS13335). The DNS configuration uses Cloudflare’s authoritative nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com. The service is protected by a Let’s Encrypt certificate (issuer: E8) and leverages Cloudflare Browser Insights and HTTP/3, suggesting the use of modern web acceleration and security features. Threat‑intel sources report that six of ninety‑five VirusTotal scanners flagged the domain, and the domain appears on four security blocklists. It is explicitly blocked by SEAL, MetaMask, PhishDestroy, and BLP‑Malware, reinforcing its classification as malicious. The combination of a recent registration date, high‑risk rating, and active blocklist entries aligns with the observed pattern of fast‑flux phishing sites that aim to evade detection while targeting unsuspecting users. Defenders should add vote‑molten.app to firewall and proxy deny lists, and ensure DNS filtering solutions block resolution to 104.21.83.18. Continuous monitoring of the domain’s DNS records is advised, as Cloudflare’s flexible configuration can allow rapid changes. Incident response teams should treat any traffic to the domain as hostile, capture related logs, and correlate with phishing‑email indicators to contain potential credential‑theft campaigns.