zreal[.]pumpvote[.]us

Analysis of the domain zreal.pumpvote.us shows that it was registered on March 06, 2026 through Dynadot LLC and resolved to the IP address 188.114.96.3, which belongs to Cloudflare’s network (AS13335) in the United States. The domain is served over HTTPS using a Let's Encrypt certificate (type E8), indicating the operator obtained a free, automated TLS certificate. DNS resolution points to Cloudflare name servers fonzie.ns.cloudflare.com and luciana.ns.cloudflare.com, a common pattern for fast‑flux or abuse‑hosting infrastructures. The page title returned by the web server is "Pump | Voting", suggesting an attempt to present a voting‑related service, though no additional branding or content details are available.

Security‑vendor scans on VirusTotal recorded three positive detections out of ninety‑four scanners, and the domain appears on two public blocklists that have already taken it offline. Both PhishDestroy and ScamSniffer have listed the domain as malicious, confirming community‑wide consensus that the site was used for a generic phishing campaign. Current status is offline, indicating that hosting has been taken down or blocked.

Uncertainty remains around the exact phishing vector—no credential‑capture page, login form, or targeted brand has been observed, and the limited public data does not disclose the payload or victim interaction flow. Defenders should continue to block the domain at DNS, proxy, and endpoint layers, add the IP address 188.114.96.3 to deny lists, and monitor for new subdomains or similarly named domains using the same Cloudflare name servers. Ongoing surveillance of Dynadot registrations and Cloudflare‑hosted assets is advised, as the infrastructure pattern is frequently reused in other phishing operations.