sec2x[.]org

This domain, sec2x.org, is identified as a credential harvesting phishing site designed to deceive users into disclosing sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. Analysis indicates the infrastructure was engineered to mimic legitimate login portals, likely targeting corporate or financial service users. The domain employed social engineering tactics, as evidenced by its classification under Google Safe Browsing’s SOCIAL_ENGINEERING flag, a designation reserved for sites that trick users into performing actions that compromise security or privacy. Infrastructure analysis reveals sec2x.org was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026, and resolved to the IP address 104.21.59.163. The domain appears on two security blocklists and is flagged by 12 out of 95 security vendors on VirusTotal, indicating widespread detection. Additional risk assessment tools, such as Gridinsoft, assigned a trust score of 0 out of 100, further corroborating its malicious nature. The domain’s recent creation date and rapid inclusion on multiple blocklists suggest a coordinated effort to deploy phishing infrastructure with minimal detection latency. Users who visited sec2x.org or entered credentials on the site should assume compromise of any submitted data. Immediate actions include resetting passwords for all accounts accessed from the same device or network during the exposure window, enabling multi-factor authentication where available, and monitoring affected accounts for unauthorized activity. System-level scans using updated security tools are recommended to detect potential malware or persistent threats. Organizations should review logs for connections to 104.21.59.163 and the domain itself, as these serve as indicators of compromise for further investigation or incident response.