vote-phnix[.]app

This domain is flagged as an active credential harvesting phishing portal targeting users of the PHNIX Portal. The site is designed to deceive visitors into entering sensitive login credentials, which are then captured by threat actors for unauthorized access to accounts or further malicious activity. The phishing page closely mimics legitimate authentication interfaces, increasing the likelihood of successful deception, particularly among users expecting to access PHNIX-related services. Analysis indicates multiple technical indicators supporting the malicious classification of vote-phnix.app. The domain was registered on May 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.51.56, which is part of Cloudflare’s network, a common tactic to obscure the true hosting origin and evade detection. The domain is flagged by 5 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists. Additionally, the site employs a Let’s Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the domain. Detected technologies include HSTS, Cloudflare, and HTTP/3, further suggesting an attempt to appear legitimate while masking malicious intent. Users who have visited vote-phnix.app or entered credentials on the site should take immediate action to mitigate potential risks. First, cease all interaction with the domain and avoid clicking any links or downloading files from it. If credentials were entered, change passwords for all accounts where the same or similar login details were used, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the relevant service providers. Organizations should also consider blocking the domain and its associated IP address (104.21.51.56) at the network level to prevent further access by employees or clients.