votes-ethereal[.]xyz

votes-ethereal.xyz is currently listed as offline but remains of interest to defenders because it has been identified as a crypto‑related phishing site. The domain was registered on 28 September 2025 through NiceNIC International Group Co., Limited and is hosted on Cloudflare’s network (ASN 13335) with the IP address 104.21.2.207 located in the United States. Authoritative name servers kianchau.ns.cloudflare.com and meilani.ns.cloudflare.com resolve the domain, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented, indicating that the site was served over plain HTTP when it was reachable.

The page title returned from the last known capture is “Pieni hetki…”, which offers no direct indication of the targeted brand or service. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on at least one public security blocklist. VirusTotal reports three positive detections out of ninety‑five scanners, reinforcing the suspicion of malicious intent. PhishDestroy has also added the domain to its blocklist, and the overall classification in the intelligence feed is “Crypto Scam”.

The combination of recent creation, low trust rating, lack of encryption, and multiple independent detections suggests an active phishing campaign aimed at luring victims into cryptocurrency‑related fraud. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any resurgence of the IP address or associated Cloudflare‑hosted assets, and consider adding the domain to internal threat‑intel feeds. Because the site is offline, a live forensic capture is not possible; however, historical snapshots, if available, should be examined for payloads or command‑and‑control indicators. Ongoing vigilance is advised, especially for users who may receive unsolicited messages referencing cryptocurrency transactions that could redirect to this domain.