votes-spectra[.]xyz

This domain, votes-spectra.xyz, was registered on 16 March 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolved to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). The site was protected by a Let's Encrypt certificate and employed Vue.js, Cloudflare Browser Insights, and HTTP/3, indicating a modern web stack. The page title observed at the time of takedown was “SGP-18: Manual Migration of Remaining APW Balances Post‑Bridge Expiry”, which suggests an attempt to lure victims with a technical‑sounding migration notice, possibly targeting cryptocurrency or token holders. The domain is currently offline, and its infrastructure has been added to three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal scanning recorded four detections out of ninety‑four security vendors, confirming that a subset of scanners identified malicious behavior. Cloudflare’s authoritative nameservers (drew.ns.cloudflare.com and eleanor.ns.cloudflare.com) continue to serve the domain, allowing rapid re‑activation if the operator chooses to relaunch. Defenders should continue to block the domain at DNS and proxy layers, monitor the underlying IP for any changes, and watch for any re‑registration attempts that reuse the same nameserver set or IP range.

Because the content has not been publicly released, the exact credential‑capture mechanisms remain unknown; however, the presence of a targeted migration‑related title and the use of a modern JavaScript framework are consistent with credential‑phishing campaigns. Organizations should educate users about unsolicited migration notices and enforce multi‑factor authentication for any services referenced in similar communications. Ongoing threat‑intel feeds should be queried for any resurgence of votes‑spectra.xyz or associated infrastructure, and any future observations should be correlated against the existing blocklist entries.