vote-troll[.]app

This domain, vote-troll.app, is actively flagged as a high-risk brand impersonation threat targeting Google. Registered on May 12, 2026, through a registrar known for facilitating abuse, the domain currently resolves to 104.21.85.106, an IP address hosted by Cloudflare in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (corey.ns.cloudflare.com and donna.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection. The domain has been blocked by multiple security providers, including PhishDestroy, MetaMask, and SEAL, and appears on three security blocklists, indicating widespread recognition of its malicious intent. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate the legitimacy of the site. At present, the domain returns an HTTP 403 status with a page title of 'Just a moment...', suggesting either a holding page, a cloaking mechanism, or an incomplete deployment. This behavior is consistent with phishing campaigns that use intermediate pages to filter traffic or evade automated analysis. The domain was identified in one AlienVault OTX threat intelligence pulse, further corroborating its association with malicious activity. While the exact phishing kit or payload remains unconfirmed, the domain’s registration details, infrastructure, and blocklist presence align with known patterns of brand impersonation. Defenders should treat this domain as hostile and prioritize blocking it at the DNS and network levels. Monitoring for related subdomains or IP associations is recommended, as threat actors often reuse infrastructure across campaigns. Given the domain’s recent creation and active status, continued vigilance is advised to mitigate potential user exposure.