vooi-vooi[.]xyz

Analysis of vooi-vooi.xyz shows a short‑lived domain created on 21 February 2026 and presently taken offline. The site was reachable through Cloudflare’s network (ASN 13335) from the United States, resolving to 172.67.177.109 and served over HTTPS using a Google Trust Services / WE1 certificate. HTTP/3 support was detected, and the domain was configured with Cloudflare‑owned nameservers darwin.ns.cloudflare.com and paislee.ns.cloudflare.com. Threat intelligence indicates the page title returned “VOOI Light – Apply to claim”, a pattern commonly associated with credential‑harvesting campaigns.

The domain appears on three independent blocklists—PhishDestroy, MetaMask, and SEAL—demonstrating that multiple industry feeds have flagged it. VirusTotal scans recorded five positive detections out of ninety‑three security‑vendor submissions, confirming that at least a subset of scanners identified malicious behavior. The registrar listed is NiceNIC International Group Co., Limited. No additional evidence such as content snapshots or sandbox analysis is currently available, leaving the exact phishing workflow unverified.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection of the host on Cloudflare’s IP space, and consider adding it to internal reputation lists. Ongoing observation of the associated IP address and related Cloudflare nameservers is advised, as attackers may reuse the same infrastructure for future campaigns. Incident response teams should also verify that any user‑submitted credentials related to the “VOOI Light” claim are treated as compromised.