org-votex[.]click

This domain, org-votex.click, is identified as an active credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the infrastructure is optimized for mimicking legitimate authentication portals, likely targeting corporate or financial services users. The site employs advanced evasion techniques, including HSTS and HTTP/3, to appear more legitimate and bypass basic security checks. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on July 02, 2026, through Dynadot, LLC, an uncommon timeline suggesting potential domain squatting or premeditated malicious intent. It resolves to IP address 31.76.98.150 and uses a Let's Encrypt SSL certificate, providing a false sense of security. VirusTotal reports 7 out of 95 security vendors have flagged this domain as malicious, with detections specifically labeling it as a phishing threat. Additionally, the presence of Google Analytics suggests the operators are monitoring victim interactions to refine their attack strategies. Users who have visited org-votex.click or entered credentials on this site should take immediate action. First, revoke any submitted credentials, particularly for email, banking, or corporate accounts, and enable multi-factor authentication where possible. Monitor accounts for unauthorized activity and report the incident to relevant security teams or fraud prevention services. Avoid interacting with any links or communications associated with this domain, as they may lead to further compromise. Organizations should block the domain and its resolving IP at the network level to prevent access from internal systems.