vote-michi[.]xyz

Analysis of vote-michi.xyz shows a short‑lived phishing infrastructure that has already been taken offline. The domain was registered on March 11, 2026 through NameSilo, LLC and resolves to the Cloudflare‑owned address 172.67.207.107, belonging to ASN 13335 in the United States. DNS resolution is handled by alaric.ns.cloudflare.com and iris.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site served an HTTP 403 response with the page title "Just a moment...", indicating that the content was likely protected by Cloudflare’s challenge page before the takedown.

SSL was provided by a Let’s Encrypt certificate issued under the E7 profile, a common choice for fast‑deployment malicious sites. VirusTotal scans recorded 2 detections out of 94 security vendors, providing modest but tangible evidence of malicious behavior. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive platforms have identified it as a threat. AlienVault OTX references the domain in a single pulse, adding another data point for threat‑intel correlation.

While the exact phishing lure or targeted brand is not disclosed beyond the generic page title, the convergence of registration timing, Cloudflare hosting, limited VirusTotal detections, and multiple blocklist inclusions strongly supports a phishing classification. Defenders should continue to block the domain at perimeter firewalls and email gateways, monitor for any re‑registration attempts, and include the associated IP address and nameservers in threat‑intel feeds. Ongoing vigilance is recommended to catch any resurgence of the infrastructure under new domain names or alternative hosting configurations.