tea-vote[.]net

This domain, tea-vote.net, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. The infrastructure is engineered to mimic legitimate authentication portals, likely targeting users of financial services, social platforms, or corporate networks. Analysis indicates the site employs obfuscated JavaScript and form spoofing techniques to capture input data before redirecting victims to benign-appearing destinations, a common tactic in credential theft operations. Infrastructure analysis reveals the domain was registered on November 11, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 185.208.158.128, which has been linked to multiple phishing campaigns in recent months. Detection metrics confirm elevated risk: VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while two independent blocklists—ScamSniffer and PhishDestroy—have actively blocked it. The domain’s trust score of 0/100 further corroborates its classification as a high-confidence threat. Users who accessed tea-vote.net or submitted credentials via the site should immediately revoke any entered passwords, particularly for accounts tied to email, banking, or enterprise systems. Multi-factor authentication (MFA) should be enabled where available to mitigate unauthorized access. Network administrators are advised to block the domain and its associated IP (185.208.158.128) at the perimeter level. If financial data was exposed, affected parties should monitor transaction logs for unauthorized activity and report incidents to relevant fraud response teams. Given the domain’s offline status, residual risk may persist through cached pages or secondary redirects, necessitating continued vigilance.