vote-phoenix[.]xyz

Analysis of vote-phoenix.xyz as of 2026-08-04 indicates that the domain is actively used in a phishing campaign. The site has been added to blocklists operated by PhishDestroy, MetaMask, ScamSniffer, and SEAL, and it appears on four additional security blocklists. VirusTotal reports five detections out of ninety-one scanners, confirming that multiple AV engines have identified malicious behavior.

No public evidence has been released regarding the page title, SSL certificate details, hosting IP address, or registrar information, so those infrastructure attributes remain unverified. The lack of disclosed HTTP response codes or Safe Browsing verdicts means the current browser-level reputation cannot be confirmed. Because the domain is already flagged by several reputable anti-phishing services, defensive teams should treat any traffic to vote-phoenix.xyz as hostile.

Recommended mitigations include adding the domain to network-level deny lists, configuring web-proxy rules to block HTTP/HTTPS requests, and ensuring endpoint protection solutions are updated to include the latest signatures that reference the five VirusTotal detections. Continuous monitoring of threat-intel feeds for any new indicators—such as resolved IP addresses, TLS fingerprints, or observed payloads—will help refine detection rules. Until additional infrastructure data becomes available, the safest posture is to block all communications with vote-phoenix.xyz and to educate users about unsolicited messages that reference voting or election-related services that could redirect to this domain.