voting-mantle[.]xyz

Analysis of voting-mantle.xyz indicates a confirmed banking phishing domain targeting the Mantle brand, currently offline but previously active. The domain was registered on October 30, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, with Cloudflare nameservers (ignacio.ns.cloudflare.com and ingrid.ns.cloudflare.com). Infrastructure analysis reveals resolution to IP 216.58.206.78, hosted on Google LLC’s AS15169 in Germany. No SSL certificate was detected, increasing susceptibility to interception.

The page title, captured from the active URL https://vote-mantle.pages.dev/, suggests a fraudulent voting or authentication theme, aligning with the reported scam type of banking phishing. Detection data confirms elevated risk: the domain appears on two security blocklists (PhishDestroy and ScamSniffer), and six of 95 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. While the domain is currently offline, defenders should treat any reactivation as a critical threat.

Organizations associated with Mantle should monitor for similar impersonation attempts, particularly domains leveraging 'vote' or 'mantle' in their structure. Given the use of Cloudflare and Google infrastructure, defenders should also assess whether additional domains share these hosting or DNS patterns. The absence of SSL and the domain’s presence on multiple blocklists warrant immediate inclusion in internal deny lists and security tooling configurations.