voting-arcium[.]com

This domain, voting-arcium.com, is actively engaged in credential theft phishing operations targeting election-related services. Analysis indicates the site is designed to harvest login credentials under the guise of voter registration or polling verification, a tactic increasingly observed in politically motivated cyber threats. The domain remains operational as of the latest verification, posing a direct risk to individuals and organizations involved in electoral processes. Infrastructure analysis reveals the domain was registered on June 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been linked to other malicious activities in recent threat intelligence reports. VirusTotal detection shows only 1 of 95 security vendors currently flagging the domain, suggesting either low detection coverage or recent activation of the phishing infrastructure. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while obscuring the malicious intent. Current status confirms the domain remains active, with no indications of takedown or sinkholing. Organizations and individuals are advised to block the domain and its associated IP at the network perimeter. Endpoint protection systems should be updated to include voting-arcium.com in phishing and malicious domain blocklists. Users should be educated to recognize social engineering tactics involving election-related lures, particularly those requesting credentials or personal information. Monitoring for similar domains using the same registrar or IP range is recommended to identify potential follow-up campaigns.