escher[.]vote

Analysis of the domain escher.vote shows a short‑lived infrastructure that was taken offline prior to this report. The domain is registered through Cloudflare, Inc. and uses Cloudflare‑provided nameservers (kianchau.ns.cloudflare.com, meilani.ns.cloudflare.com). DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335, Cloudflare, Inc., and is geolocated in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid, publicly trusted HTTPS endpoint despite the domain’s malicious purpose.

When accessed, the server returned an HTTP 403 status code, and the page title returned by the HTTP response was the Hebrew phrase “רק רגע…”, which translates to “Just a moment…”. No further content has been captured, and the site’s visual appearance is unknown. VirusTotal records indicate that two of ninety‑five scanned security vendors flagged the domain, suggesting limited but present detection by some anti‑malware products. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy remediation service.

Risk level is listed as elevated, and the current operational status is offline. Defenders should continue to monitor the IP address 188.114.96.3 for any re‑use in future campaigns, enforce blocklists that include escher.vote, and consider adding the domain to internal phishing detection rules. Because the page title offers no clear indication of a targeted brand or service, attribution to a specific impersonated entity remains uncertain. Monitoring for any new DNS or SSL changes associated with the domain’s registrar (Cloudflare) is recommended to detect potential re‑activation.