vote[.]hub-kinetiq[.]xyz

This domain, vote.hub-kinetiq.xyz, is identified as an active credential harvesting phishing site targeting users of the Kinetiq platform. Analysis indicates the page mimics legitimate Kinetiq authentication portals, presenting a high-risk threat of unauthorized account access and data exfiltration. The site employs deceptive login interfaces to capture sensitive credentials, which are likely transmitted to attacker-controlled infrastructure for subsequent exploitation in fraud or identity theft operations.

Infrastructure analysis reveals the domain was registered on June 12, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.46.166 and is currently flagged by 4 security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. VirusTotal detection metrics report 2 out of 95 security vendors have flagged the domain as malicious. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate legitimacy, as phishing sites commonly abuse trusted certificate authorities to appear credible.

Users who have interacted with vote.hub-kinetiq.xyz are advised to take immediate remedial actions. All credentials entered on the site should be considered compromised and must be reset across all platforms where identical or similar passwords were used. Enable multi-factor authentication on critical accounts to mitigate unauthorized access risks. Monitor financial and digital accounts for suspicious activity, and report the incident to relevant security teams or incident response platforms. Network administrators should update firewall and endpoint protection rules to block the domain and its resolving IP address, 104.21.46.166, to prevent further exposure within organizational networks.