vote-nestusd[.]xyz

This domain, vote-nestusd.xyz, is assessed as a high-risk generic phishing threat based on current intelligence. Registered on July 2, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain remains active as of July 12, 2026. It resolves to IP address 172.67.218.19, which is hosted by Cloudflare, Inc. in Canada. The page title retrieved is 'FASTPANEL,' a default placeholder often associated with hosting panels rather than legitimate content, indicating the site may be under construction or deliberately obscuring its true purpose. VirusTotal analysis shows 5 of 91 security vendors flagging this domain, and it appears on three security blocklists. Specific blocks are reported by PhishDestroy, MetaMask, and SEAL. The infrastructure employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, with an SSL certificate issued by Google Trust Services (WE1). Nameservers are kayleigh.ns.cloudflare.com and piers.ns.cloudflare.com. The exact nature of the phishing campaign is not yet fully characterized, as no brand, scam category, or kit has been identified from the available data. Defenders should treat this domain as actively hostile, monitor for associated infrastructure changes, and maintain blocks on email and web gateways. Users should avoid any interaction with the domain until further analysis clarifies the specific threat vector.