votes-etherfi[.]cloud

The domain votes-etherfi.cloud has been identified as a malicious phishing resource and is currently active under investigation. VirusTotal records indicate that the domain was scanned by 91 independent security vendors; none of the submissions produced a detection. This lack of detections is recorded only as a data point and does not constitute evidence of safety.

The domain is listed on a single external security blocklist, and it is explicitly blocked by the PhishDestroy mitigation service, demonstrating that at least one reputable anti‑phishing provider has taken protective action against it. No additional public intelligence—such as registrar data, ASN, hosting details, SSL certificate information, HTTP response codes, or page‑title content—has been disclosed, leaving those infrastructure attributes unverified. Because the available evidence is limited to blocklist presence and the VirusTotal scan result, analysts should treat the domain as hostile until further forensic details emerge.

Recommended defensive steps include adding votes-etherfi.cloud to local and network‑wide deny lists, ensuring that email gateway filters reference the blocklist entry, and monitoring outbound traffic for any connections to the domain. Continuous re‑evaluation is advised as new telemetry becomes available, particularly any future detections from sandbox or endpoint products that could clarify the payload or credential‑harvesting mechanisms employed by the site.