voting-originprotocol[.]xyz

The domain voting-originprotocol.xyz was registered on December 5, 2025 through Dynadot LLC and is currently taken offline. Infrastructure analysis shows it resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No SSL certificate is present on the host, indicating that any traffic to the domain would have been unencrypted. The domain’s nameservers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, both operated by Cloudflare, a common choice for fast‑deployment phishing infrastructure.

Gridinsoft assigns the domain a trust score of 0 out of 100, reflecting a complete lack of legitimacy. VirusTotal reports that 6 of 95 scanned security vendors flag the domain as malicious, corroborating its classification as a banking phishing site. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service.

The known scam type is Banking Phishing, but no page title or content analysis is available, leaving the exact lure or credential‑capture method unverified. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host, and consider adding the IP address 188.114.96.3 to blacklist rules. Because the domain is already offline, any active campaigns are likely halted, yet the infrastructure could be reused for future campaigns, so ongoing vigilance is advised.