vote-xitadel[.]xyz

PhishDestroy identifies vote-xitadel.xyz as an active generic phishing domain deployed in a low-detection campaign targeting unsuspecting users. The domain exhibits no affiliation with established brands or drainer kits, suggesting a generic lure likely leveraging urgency or impersonation. Technical artifacts align with opportunistic phishing rather than a sophisticated operation, but early-stage campaigns often escalate rapidly as threat actors refine tactics. Users should exercise extreme caution when encountering this domain or any associated links.

This domain was flagged on April 22, 2026, via seed ed0175 and exhibits multiple indicators of active exploitation. VirusTotal currently reports 4/95 security vendor detections, indicating minimal detection coverage despite clear malicious intent. It is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, resolves to IP 188.114.97.3, and holds a Let's Encrypt SSL certificate. Google Safe Browsing (GSB) status remains unflagged, and no known blocklists have yet categorized this domain. The absence of detections and recent registration date suggest a newly launched campaign with high potential for rapid expansion.

The campaign remains active as of the latest assessment, with no active takedown or mitigation observed. Immediate response is critical: users should block the domain at network and endpoint levels, report to relevant authorities (e.g., CERT, domain registrar, and security vendors), and avoid accessing any content hosted on 188.114.97.3 or vote-xitadel.xyz. Remaining risk is assessed as HIGH due to low detection coverage, recent activation, and potential for rapid campaign evolution. Threat intelligence teams are advised to monitor for derivative domains, infrastructure shifts, or the emergence of drainer scripts. This investigation is ongoing, and further updates will be provided as new intelligence emerges.