votings-virtual[.]pages[.]dev

The domain votings-virtual.pages.dev is currently active and hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.177, which is geolocated to Canada and owned by Cloudflare, Inc. Registration information shows the site was provisioned through Cloudflare Pages, a typical serverless hosting service, and the TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS configuration. An HTTP GET request returns a 200 OK status, confirming that the web service is reachable and serving content. VirusTotal analysis reports that 3 of 91 security vendors have flagged the domain, suggesting that a minority of scanners have identified malicious characteristics. The domain appears on four security blocklists, specifically PhishDestroy, MetaMask, ScamSniffer, and SEAL, demonstrating that multiple independent threat intelligence feeds have recognized it as a threat.

The risk rating assigned is high, and the threat type is categorized as generic phishing, implying that the site is likely used to harvest credentials or personal data without targeting a specific brand. No additional details such as page title, brand impersonation, or malware kit have been disclosed, leaving the exact content and attack vector unverified. Defenders should prioritize blocking the domain at perimeter firewalls, DNS resolvers, and proxy filters, and ensure that endpoint detection platforms incorporate the listed blocklist identifiers.

Continuous monitoring of DNS queries for the IP 172.66.44.177 and associated Cloudflare ASN is recommended to detect any pivoting activity. Organizations should also review authentication logs for attempts to submit credentials to unknown voting portals and enforce multi-factor authentication to mitigate credential theft. Given the active status and high risk, ongoing intelligence gathering and periodic re‑scanning of the domain are advised to capture any evolution in its malicious behavior.