vaocox[.]com

PhishDestroy identifies vaocox.com as an active credential harvesting domain engaged in targeted phishing campaigns.

This domain employs a classic credential theft strategy by masquerading as a legitimate login portal to harvest user credentials. Security telemetry confirms that vaocox.com has been flagged by 1 out of 95 VirusTotal vendors, indicating limited but confirmed malicious activity. The domain was registered on April 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, and resolves to IP address 188.114.97.3. Notably, the site utilizes a Let's Encrypt SSL certificate, which may lend false credibility to potential victims. At the time of analysis, this domain remains unblocked by major threat intelligence platforms, presenting an elevated risk to users who may encounter it.

Given its recent registration and minimal detection coverage, vaocox.com represents a dynamic threat capable of rapid evolution. The infrastructure—hosted on a shared IP with known malicious associations—suggests opportunistic rather than targeted deployment. While the immediate phishing payload is not fully documented, the lack of widespread blocklisting underscores the need for proactive monitoring. Current evidence points to active exploitation but with low operational maturity, as evidenced by the single VirusTotal detection.

Users are strongly advised to avoid interacting with vaocox.com and to treat any unsolicited communications referencing this domain as suspicious. Organizations should implement DNS-based blocking for this domain and monitor network traffic for connections to 188.114.97.3. Additionally, users are encouraged to verify website authenticity through official channels before entering credentials. Security teams should prioritize this domain for further behavioral analysis due to its elevated risk profile and emerging threat status.