poll-hedera[.]xyz

Analysis of poll-hedera.xyz shows a confirmed phishing infrastructure hosted on Cloudflare. The domain resolves to IP 104.21.2.207, which belongs to AS13335 Cloudflare, Inc., and is geolocated in the United States. Registration data indicates the domain was created on December 05, 2025 and was registered through Dynadot LLC. No TLS certificate is present, meaning HTTPS connections are not secured. The authoritative name servers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, both Cloudflare‑managed, consistent with the hosting provider.

The page title observed during the brief crawl was "Prime Budgeting Experts," but the site has been taken offline at the time of analysis, and no active HTTP response is available for further content inspection. Threat intelligence signals include a single AlienVault OTX pulse referencing the domain, inclusion on one public security blocklist, and a block by PhishDestroy. VirusTotal reports six out of ninety‑five security vendors flagging the domain as malicious, corroborating the phishing classification. Gridinsoft assigns a trust score of 0 out of 100, indicating a highly untrusted reputation.

Uncertainty remains regarding the specific phishing campaign details, such as target victim demographics or credential‑harvesting mechanisms, because the site content is no longer accessible. Defenders should immediately add poll-hedera.xyz to network deny lists, monitor DNS queries for the domain and its associated IP address, and consider broader Cloudflare edge blocks if similar patterns appear. Continuous re‑evaluation is advised in case the domain becomes active again or new indicators emerge.