voting-nado[.]xyz

PhishDestroy analysts have flagged voting-nado.xyz as an active generic phishing domain that poses a voting fraud threat. The page is configured to harvest voter credentials and payment data under the guise of a fake voting portal. No specific brand or drainer kit signature has been released publicly; the infrastructure is generic and designed for broad targeting rather than a single high-profile brand. Technical indicators are as follows: VirusTotal returns 7/95 detections as of this report, the domain resolves to IP 104.21.31.235, and it was registered on April 04, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Google Safe Browsing has not yet flagged the domain, and it remains absent from all major real-time blocklists at this time. The domain is currently active under investigation with a risk level marked as under_investigation. Users should avoid interacting with this domain and ensure browser protections are enabled. Remaining risk is moderate due to the domain’s young age, lack of detection, and absence from blocklists, which suggests the phishing campaign may still be in early deployment. Organizations are advised to monitor for related artifacts and block the IP and domain at the network perimeter.