votenote[.]cc

This domain, votenote.cc, was registered on May 12, 2026 through Global Domain Group LLC and resolves to the Cloudflare‑owned address 188.114.96.3 located in Canada. The authoritative name servers are diana.ns.cloudflare.com and johnny.ns.cloudflare.com, indicating the use of Cloudflare DNS. The site presents an SSL certificate issued by Let’s Encrypt (identifier E8), which is typical for rapidly deployed malicious sites.

The landing page returns HTTP 200 and carries the title “DEX Screener | Voting”, a combination that mimics legitimate decentralized‑exchange interfaces to lure users into credential submission. Security telemetry shows the domain appears on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal records two detections out of ninety‑five scanners, confirming that at least two security vendors have identified malicious behavior. Gridinsoft’s trust score of 0/100 further corroborates the lack of legitimate reputation.

While the current evidence strongly points to a high‑risk generic phishing operation, the limited number of VirusTotal detections leaves open the possibility of additional payloads or secondary infrastructure not yet observed. Defenders should add votenote.cc to deny‑list rules, enforce TLS inspection to capture credential submissions, and monitor DNS queries for the associated Cloudflare name servers. Continuous threat‑intel correlation with AlienVault OTX, which references one pulse, is recommended to detect any expansion of the campaign.