p3[.]etox[.]click

This domain, p3.etox.click, is flagged as a credential harvesting phishing site designed to deceive users into submitting login credentials, financial details, or other sensitive information. Analysis indicates the infrastructure was configured to mimic legitimate services, likely targeting users through email, SMS, or malicious advertisements. The domain's page title, 'Site is created successfully!', suggests it was part of a larger phishing kit or automated deployment system, where threat actors rapidly spin up fraudulent pages for short-term campaigns. Evidence supporting the classification includes detection by 16 out of 95 security vendors on VirusTotal, placement on one security blocklist, and registration through Sav.com, LLC on August 30, 2025. The domain resolved to IP address 178.16.53.103, hosted on AS202412 (Omegatech LTD) in the Netherlands, with no SSL certificate present. The absence of encryption and the use of a recently registered domain align with common phishing tactics to evade detection and maximize short-term impact. Users who visited p3.etox.click or interacted with any content from this domain should assume potential exposure of credentials or personal data. Immediate actions include resetting passwords for any accounts accessed during the exposure window, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. Devices used to access the site should undergo a full malware scan, as phishing pages often deploy secondary payloads. Network administrators are advised to block the domain and its associated IP at the perimeter to prevent further access attempts.