vote-capmoney[.]pages[.]dev

Analysis of the domain vote-capmoney.pages.dev indicates a high-risk phishing campaign impersonating the CAP Money Course, associated with the organization Christians Against Poverty as suggested by the page title. The domain was registered on October 29, 2025, through Cloudflare, Inc., and remains active as of July 12, 2026. Infrastructure analysis reveals the domain resolves to the IP address 172.66.47.179, hosted on Cloudflare's network (AS13335) in the United States. The domain employs Cloudflare nameservers (mitch.ns.cloudflare.com and gigi.ns.cloudflare.com) and utilizes an SSL certificate issued by Google Trust Services (WE1), which may contribute to the appearance of legitimacy. The domain is flagged by multiple security mechanisms, including PhishDestroy and ScamSniffer, and appears on two security blocklists. Detection engines on VirusTotal have flagged the domain, with 7 out of 95 security vendors identifying it as malicious. Google Safe Browsing has classified the domain under the SOCIAL_ENGINEERING category, further corroborating its phishing nature. The site's trust scores from Scamadviser and Gridinsoft are both at the lowest possible level (1/100 and 0/100, respectively), indicating a high likelihood of fraudulent activity. Technologies detected on the domain include jsDelivr, HSTS, Cloudflare, and HTTP/3, which are commonly used in both legitimate and malicious websites to enhance performance and security. However, the combination of these technologies with the domain's low trust scores, blocklist presence, and phishing classification suggests malicious intent. The exact content and mechanics of the phishing campaign are not yet analyzed, but the domain's infrastructure and detection history align with known phishing tactics. Defenders should prioritize blocking this domain at the network level, particularly given its active status and high-risk classification.