vote-usro[.]com

Analysis indicates that the domain vote-usro.com was registered on 21 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) and located in the United States. DNS resolution uses the Cloudflare authoritative nameservers felicity.ns.cloudflare.com and tricia.ns.cloudflare.com. The site presents a Japanese page title “しばらくお待ちください...” and returns an HTTP 403 status code, suggesting that direct content access is blocked. TLS termination is provided by a Google Trust Services certificate issued under the WE1 brand, confirming the use of a legitimate certificate authority.

Infrastructure observations show that the site employs Cloudflare Browser Insights, Cloudflare edge services, and HTTP/3, indicating modern delivery mechanisms. Reputation data is poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist. PhishDestroy has already listed the domain as blocked, and VirusTotal reports that six of ninety‑three scanned security vendors flag the domain, reinforcing the malicious classification. The collected evidence points to an active phishing campaign that likely attempts to harvest credentials, although the exact payload or target brand cannot be confirmed from the available data.

Uncertainty remains regarding the specific phishing lures used, as the page content has not been publicly disclosed beyond the generic waiting title. Defenders should block DNS resolution for vote-usro.com, enforce URL filtering, and monitor outbound connections to the associated Cloudflare IP range. Network sensors should flag any HTTP/3 traffic to 188.114.96.3, and endpoint security solutions should treat detections from the six VirusTotal‑positive vendors as high‑confidence indicators. Continuous re‑evaluation is advised in case additional detection signatures appear.