vote-virls[.]xyz

This domain, vote-virls.xyz, is confirmed to be a credential theft site. The domain is designed to trick users into divulging sensitive login credentials, potentially leading to unauthorized access to personal accounts and data. The infrastructure is sophisticated, utilizing Cloudflare services to mask its true nature and evade detection.

Analysis indicates that the domain has a Gridinsoft trust score of 0/100, which is the lowest possible score, suggesting a high likelihood of malicious intent. Despite having 0/95 detections on VirusTotal, the domain appears on 3 security blocklists, including MetaMask, PhishDestroy, and SEAL. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 25, 2026, and currently resolves to the IP address 104.21.22.47. The use of HTTP/3 and Cloudflare Browser Insights further suggests that the operators are employing advanced techniques to enhance the site's performance and reliability while maintaining a low profile.

If users have visited vote-virls.xyz, they are advised to immediately change the passwords for any accounts they may have entered credentials into while on the site. Additionally, users should enable two-factor authentication (2FA) on all critical accounts to add an extra layer of security. It is also recommended to run a comprehensive security scan on the affected device to ensure no additional malware was installed and to monitor account activity for any signs of unauthorized access.