voltrix[.]pw

This domain, voltrix.pw, operates as a credential harvesting phishing site designed to mimic legitimate authentication portals. Analysis indicates the site employs deceptive login interfaces to capture sensitive user credentials, including usernames, passwords, and potentially multi-factor authentication tokens. The infrastructure is configured to appear legitimate, utilizing SSL encryption (Let's Encrypt certificate E8) to bypass initial security warnings and increase victim trust. The page title 'Just a moment...' suggests the use of evasion techniques, such as cloaking or delayed content loading, to hinder automated detection systems and prolong operational uptime. Technical indicators confirm the malicious nature of voltrix.pw. The domain is flagged by 20 out of 95 security vendors on VirusTotal, with detections spanning phishing, fraud, and malicious URL categories. Registered on April 22, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, the domain resolves to the IP address 104.21.73.186, hosted on Cloudflare's network (AS13335). This hosting choice is notable, as Cloudflare's services are frequently leveraged by threat actors to obscure server origins and resist takedown efforts. The domain appears on at least one security blocklist, though its relatively low blocklist count may reflect its recent deployment or successful evasion tactics. Users who have visited voltrix.pw or interacted with its content should take immediate remedial actions. Any credentials entered on the site must be considered compromised and reset across all platforms where they were reused. Multi-factor authentication (MFA) tokens or recovery codes associated with the affected accounts should also be revoked and replaced. System scans using updated security tools are recommended to detect potential secondary infections, such as malware or browser-based persistence mechanisms. Organizations should add the domain and its resolving IP (104.21.73.186) to network-level blocklists to prevent further exposure. Monitoring for unauthorized access or anomalous activity on linked accounts is critical for the next 30 days, as credential harvesters often sell or exploit stolen data in delayed campaigns.