vote-tydro[.]com

vote-tydro.com was registered on 11 May 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers dorthy.ns.cloudflare.com and jerome.ns.cloudflare.com resolve the domain to the Cloudflare IP 188.114.96.3, located in Canada. The site presents a valid Let's Encrypt certificate (issuer E7), indicating that TLS termination is handled by the CDN. No additional hosting details are visible beyond the Cloudflare edge. The domain appears on three security blocklists and is listed in a single AlienVault OTX pulse. It is actively blocked by PhishDestroy, MetaMask, and SEAL, and a recent scan on VirusTotal resulted in five out of ninety‑five security vendors flagging it as malicious. An HTTP request to the site returns a 403 status code, preventing direct content inspection but confirming the presence of an active web service. Infrastructure analysis points to a typical phishing deployment: rapid domain creation, use of a reputable CDN to hide origin, and a low Gridinsoft trust score of 0 out of 100, which reflects a high likelihood of abuse. The combination of a freshly minted domain, short‑lived TLS certificate, and immediate inclusion on blocklists suggests the site is being used for credential harvesting, likely targeting users of popular online services. Because the HTTP response is restricted, the exact phishing payload cannot be confirmed, leaving the specific lure and targeted brand uncertain. Defenders should add vote-tydro.com to deny‑list rules at perimeter and DNS filtering points, and monitor for any outbound connections to the 188.114.96.3 address. Threat‑intel teams are advised to continue tracking the domain’s activity on blocklists and to share any newly observed payloads with the broader community. If possible, sinkholing the domain via the Cloudflare nameservers may disrupt the campaign, and users should be reminded to verify TLS certificates and URL authenticity before entering credentials.