votes-tea[.]com

The domain votes-tea.com was observed on July 12, 2026 and assigned a high risk rating. It is currently active and hosted on a CDN network. The site presents a page titled "Tea — Vote" and returns HTTP 200, indicating a live front‑end likely intended to lure victims into a credential‑stealing workflow. Registration data shows the domain was created on May 27, 2026 through a public domain registration service. The authoritative name servers are destiny.ns and james.ns, both pointing to a major CDN provider. DNS resolution returns the address 104.21.76.88, which belongs to a data‑center located in Canada and is associated with the CDN operator's network. The site serves a TLS certificate issued by a free automated certificate authority, using the E7 profile. Scanning on VirusTotal recorded two positive detections out of ninety‑five scanners, and the domain appears on three independent security blocklists. Automated reputation services assign a trust score of zero out of one hundred, reinforcing the malicious classification. Analysis indicates the infrastructure aligns with known phishing campaigns that exploit short‑lived domains and rely on reputable hosting to evade simple blocking. While the exact phishing kit or targeted brand is not disclosed, the combination of a fresh registration, low trust score, and presence on blocklists suggests a deliberate credential‑harvesting operation. Defenders should block the domain at the network perimeter, update URL filtering policies, and monitor for related DNS queries. End users should be warned to avoid any unsolicited voting or survey links that reference tea or voting themes, as these appear to be the lure employed by this campaign.