vote-mv[.]rest

Analysis of vote-mv.rest indicates this domain was actively flagged as a phishing threat targeting Russian-speaking users, specifically mimicking a regional veterinary awards competition. The domain, registered on November 12, 2025, through Web Commerce Communications Limited, resolved to IP 83.217.208.221 hosted on AS205775 (NEON CORE NETWORK LLC) in Germany. The page title, 'Региональный ежегодный конкурс «Лучший ветврач г. Пермь»', suggests an attempt to impersonate a legitimate awards program for veterinarians in Perm, Russia, though no confirmed brand association or official event link has been established. Infrastructure review shows the domain used Cloudflare nameservers (aitana.ns.cloudflare.com, kevin.ns.cloudflare.com) and lacked an SSL certificate, increasing exposure to interception risks.

At the time of assessment, the domain was offline, but prior detections include one threat intelligence pulse on AlienVault OTX and a listing on one security blocklist. PhishDestroy explicitly blocked the domain, and Gridinsoft assigned a trust score of 0/100. Sixteen of 95 security vendors on VirusTotal flagged the domain as malicious, though the specific phishing kit or payload remains unconfirmed. Defenders should treat this domain as a confirmed phishing threat, particularly in environments serving Russian-speaking users or veterinary professionals.

The absence of SSL, use of Cloudflare, and hosting on a bulletproof ASN align with common phishing infrastructure patterns. While the domain is currently inactive, historical DNS and WHOIS records should be preserved for incident response. No evidence suggests this campaign targeted other regions or languages, but monitoring for similar domains using the same awards-themed pretext is recommended. Further analysis of the IP and ASN may reveal additional linked domains or campaigns.