This technical report documents the ongoing risks associated with coinvotelisting-cc.netlify.app, identified and flagged as a high-risk generic phishing domain as of July 28, 2026. The domain is registered through Netlify and currently lacks assigned nameservers (NS_NOT_FOUND), which is an indicator of non-standard or temporary hosting infrastructure, commonly seen in phishing campaigns. The domain remains active at the time of this analysis and resolves to the IP address 63.176.8.218.
coinvotelisting-cc.netlify.app has been independently blocked by three security entities: PhishDestroy, MetaMask, and SEAL. Its presence on these blocklists demonstrates a consensus among threat intelligence vendors regarding its malicious use. Notably, this domain has been scanned by 91 vendors on VirusTotal, and while none currently flag it, it is important to emphasize that the absence of detections does not confirm legitimacy or safety. Phishing actors regularly employ techniques to evade automated scanning and detection tools, so defenders should not rely solely on a lack of detections when assessing risk.
No brand or specific scam type has been attributed to this domain based on available intelligence, and its exact page content has not yet been analyzed. However, the convergence of blocklistings, non-standard hosting, and active status signals a significant risk to users. Security teams are advised to block traffic to coinvotelisting-cc.netlify.app and the associated IP 63.176.8.218 within enterprise and personal security controls. Continued monitoring for related infrastructure is recommended, as threat actors may pivot to similar assets. Defenders should inform end users of the ongoing risks and ensure phishing awareness remains a priority. Further review and takedown efforts are warranted given the ongoing activity and consensus across multiple security sources.