voting-aethir[.]xyz

The domain voting-aethir.xyz was registered on 27 February 2026 through NiceNIC International Group Co., Limited. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The domain uses Cloudflare’s default nameservers gwen.ns.cloudflare.com and terry.ns.cloudflare.com and does not present an SSL/TLS certificate, indicating that HTTPS connections are not available. A single page was observed with the title “Aethir”. The site is classified as a crypto‑scam phishing operation.

VirusTotal scans have recorded 2 detections out of 93 security vendors, confirming that at least two anti‑malware engines flagged the domain as malicious. The domain appears on one external blocklist and has been actively blocked by the PhishDestroy filtering service. No additional intelligence such as Safe Browsing, OTX, or kit attribution is available at this time. The infrastructure is currently offline, as indicated by the status field, which suggests the hosting has been taken down or the site is otherwise unreachable.

Because the domain was only active for a short period after its registration, threat actors may have used it to target cryptocurrency users before removal. Defenders should continue to monitor the IP address 188.114.97.3 for any re‑use, enforce blocklist updates that include voting‑aethir.xyz, and apply outbound filtering for connections to newly registered domains that resolve to Cloudflare IP ranges without TLS. Incident response teams should also review any recent logs for attempts to contact this domain or its IP, especially from endpoints handling cryptocurrency wallets or exchanges. The lack of SSL and the brief lifespan reduce the likelihood of persistent payload delivery, but the observed detections indicate a real risk to users who may have visited the site while it was live.