vote-fwa[.]fun

Analysis indicates that the domain vote-fwa.fun was registered on July 25 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative nameservers are dom.ns.cloudflare.com and uma.ns.cloudflare.com, indicating that the domain is using Cloudflare’s DNS infrastructure. DNS resolution points to IP address 188.114.96.3. The domain appears on a single security blocklist; PhishDestroy has listed it as malicious and the blocklist status remains active as of the report date.

VirusTotal has recorded a single positive detection out of 91 scanned vendors, confirming that at least one security product has identified the domain as malicious. No additional public threat‑intel feeds such as OTX or Google Safe Browsing are referenced in the available data. The limited detection surface suggests that the domain is newly created and may be part of a short‑lived phishing campaign, but the exact content, target brand, or phishing kit has not been disclosed.

Because the domain is actively resolving and is already flagged by a reputable blocklist, defenders should block network traffic to vote‑fwa.fun at the firewall or DNS level, monitor for any outbound connections to the associated IP address, and consider adding the domain to internal blocklists. Further investigation should include retrieving the HTTP response, examining SSL certificate details, and analyzing any payload delivered by the site to determine the specific phishing vector. Until additional evidence is gathered, the domain should be treated as high‑risk.