votes-ondo[.]xyz

Analysis of votes-ondo.xyz indicates a recently activated phishing domain targeting election-related credentials. The domain was registered on July 25, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to IP address 62.60.226.88. Nameservers are hosted on coco.bunny.net and kiki.bunny.net, a configuration often observed in bulletproof or low-cost hosting environments. As of July 26, 2026, the domain appears on one security blocklist, specifically PhishDestroy, though it remains unflagged by 91 detection vendors in a recent scan.

The absence of detections does not confirm safety, as phishing domains frequently evade initial scans through rapid rotation or evasion techniques. Infrastructure review shows the domain is still active, though the exact content and targeted brand have not yet been fully analyzed. The name 'votes-ondo' suggests an attempt to mimic an official election or voter registration portal, likely leveraging current events or regional election cycles.

Defenders should treat this domain as high-risk for credential harvesting or misinformation campaigns. Recommended actions include blocking the domain and IP at perimeter security controls, monitoring for internal connections to 62.60.226.88, and alerting users to potential election-themed phishing attempts. Further analysis is required to determine the specific lure, payload, or associated threat actor infrastructure.