vote-flap[.]sh

The domain vote-flap.sh was registered on July 15, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolvable via the Cloudflare nameservers holly.ns.cloudflare.com and kyle.ns.cloudflare.com. DNS resolution points to the IP address 104.21.33.214, which is part of Cloudflare’s globally distributed edge network, indicating that the site is being hosted behind Cloudflare’s reverse‑proxy service. The domain appears on a single public blocklist; PhishDestroy has listed it as malicious, providing the only known external indication of abuse.

VirusTotal records show that the domain has been scanned by 95 antivirus and URL‑reputation vendors, and none of those engines reported a detection at the time of analysis. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange (OTX) reports, SSL certificate details, HTTP response codes, trust‑score metrics, or page‑title metadata is presently available. Consequently, the current evidence base consists primarily of registration data, DNS infrastructure, the Cloudflare hosting profile, and its inclusion on the PhishDestroy blocklist.

The lack of detections by scanning engines does not imply benign intent, and the recent creation date suggests the domain may be part of a short‑lived phishing campaign. Defenders should consider proactively blocking vote-flap.sh at network perimeters and DNS filtering layers, monitor for any newly observed payloads or URLs that resolve to the same IP address, and continue to track updates from reputation services. Ongoing scrutiny of Cloudflare‑hosted domains with similar registration patterns is recommended to catch potential follow‑on infrastructure before further malicious activity materialises.