xaman-voting[.]org

Analysis of xaman-voting.org indicates that the domain is actively leveraged for phishing activity. VirusTotal records show that four out of ninety-one security vendors have flagged the domain, providing an early indication of malicious intent. The domain resolves to the IP address 104.21.22.65, which is associated with known malicious hosting infrastructure used in prior phishing campaigns.

Independent blocklist providers have taken action: PhishDestroy, MetaMask, and SEAL all list the domain as blocked, and it appears on three additional security blocklists, reinforcing the consensus that the domain is being used to deceive users. Concrete evidence is limited to these infrastructure indicators; no publicly available details about the site’s page title, SSL certificate, HTTP response codes, or content have been disclosed, leaving the exact phishing vector and targeted brand unspecified. Defenders should treat the domain as high‑risk: incorporate the IP address and domain into DNS sinkhole or firewall deny lists, monitor outbound traffic for connections to 104.21.22.65, and ensure that email security gateways are configured to block URLs referencing xaman-voting.org.

Continuous threat‑intel feeds should be consulted for any updates on detection vendor classifications or additional blocklist entries. Until further content analysis is available, the precautionary measures outlined above constitute the recommended response to mitigate exposure to this active phishing threat.