voting-tibbirs[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Google. Analysis indicates the site was designed to deceive users by mimicking Google’s branding, likely to harvest credentials, distribute malware, or conduct fraudulent activities under false pretenses. The specific threat type—brand impersonation—exploits trust in a well-known technology provider to lower user defenses and increase the likelihood of successful compromise.

Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain voting-tibbirs.com was registered on October 10, 2025, through NiceNIC International Group Co., Limited, and resolves to the IP address 216.58.206.78. On VirusTotal, 3 out of 95 security vendors flagged the domain as malicious, while GridinSoft assigned a trust score of 0 out of 100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. The page title observed at https://voting-tibbirs.pages.dev further confirms the impersonation attempt, as it aligns with tactics used in credential theft campaigns targeting enterprise and consumer users.

Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and subdomains into firewalls, email gateways, and endpoint protection systems. Users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the exposure window, particularly those linked to Google services. Security teams are advised to monitor for anomalous authentication attempts or unauthorized access originating from accounts potentially compromised through this campaign. Awareness training should emphasize verification of domain authenticity before entering credentials, especially when prompted by unsolicited communications.