voting-virtual[.]co

Analysis of the domain voting-virtual.co indicates an active high-risk phishing campaign targeting banking credentials, operational as of July 24, 2026. The domain was registered on February 21, 2026, through OwnRegistrar, Inc., a registrar previously associated with fraudulent domain registrations. Infrastructure analysis reveals Cloudflare hosting (AS13335), with the domain resolving to IP 172.67.128.246, geolocated in the United States. Nameservers julio.ns.cloudflare.com and sima.ns.cloudflare.com further confirm Cloudflare infrastructure, while detected technologies include HTTP/3, consistent with modern phishing kits designed to evade detection.

The domain is flagged on three security blocklists, including PhishDestroy, MetaMask, and SEAL, reflecting confirmed malicious activity. Despite a 404 Not Found page title, the HTTP status returns 200, suggesting server-side cloaking or a temporary inactive state while retaining operational infrastructure. VirusTotal reports three security vendors flagging the domain as malicious, though the absence of broader detection does not preclude its threat status. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent legitimacy, as phishing domains frequently leverage valid certificates to appear trustworthy.

Current evidence classifies this as a banking phishing campaign, though the exact brand impersonation remains unconfirmed due to the lack of visible page content. Defenders are advised to block the domain and associated IP at the network level, monitor for related subdomains or redirects, and correlate with existing threat intelligence feeds. Given the domain's persistence and Cloudflare hosting, takedown efforts may require registrar engagement, though OwnRegistrar's historical responsiveness to abuse reports remains inconsistent.