votes-stable[.]cloud

Analysis of votes-stable.cloud indicates an active generic phishing campaign targeting credential collection. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and created on August 05, 2026, suggesting a very recent deployment. DNS resolution points to IP address 172.67.150.180, a Cloudflare edge node that hosts a large volume of unrelated content, complicating direct attribution of the malicious operator.

The domain has been added to a single security blocklist and is explicitly blocked by the PhishDestroy feed, providing early indicator coverage for defenders. VirusTotal scanned the domain with 91 antivirus and URL scanners; none returned a malicious verdict, but the lack of detections does not constitute a safety guarantee and should be interpreted as inconclusive given the domain’s fresh creation date. No public Safe Browsing, OTX, SSL certificate details, HTTP response codes, trust‑score metrics, page title, or additional evidence links are currently available, leaving many behavioral aspects unverified.

Uncertainty remains around the specific phishing landing page, the targeted brand, and the malware delivery mechanism, as no page‑level analysis has been disclosed. Defenders should proactively block votes-stable.cloud at DNS and proxy layers, incorporate the domain into existing URL filtering lists, and monitor for any anomalous traffic to the associated Cloudflare IP. Continuous re‑scanning with sandbox and reputation services is advised to capture any future payloads or content changes.