vote-base[.]club

vote-base.club was observed to resolve to the IPv4 address 185.102.115.16, which is hosted by Partner Hosting LTD in the United States. The domain was registered through Dynadot LLC on 22 October 2025 and uses Cloudflare name servers (kevin.ns.cloudflare.com, aitana.ns.cloudflare.com). Malware analysis platforms have flagged the domain: 16 of 93 VirusTotal scanners raised detections, and the feed PhishDestroy has listed it as a confirmed phishing host. The domain appears on a single external blocklist.

Current WHOIS and passive DNS indicate the site has been taken offline, but the historical infrastructure remains relevant for threat hunting. The indicated scam type is brand impersonation, suggesting the operator intended to harvest credentials or personal data by masquerading as a legitimate brand, although the specific targeted brand is not disclosed in the available data. No public page title, SSL certificate details, or Safe Browsing verdict were captured, so the exact content of the landing page cannot be verified. The combination of a recent registration date, use of a reputable registrar, and rapid deployment of Cloudflare DNS aligns with typical phishing infrastructure that seeks to benefit from fast‑time‑to‑live and hide origin.

Defenders should add 185.102.115.16 to network blocklists, monitor DNS queries for vote-base.club and its Cloudflare name servers, and enforce URL filtering rules that include domains flagged by PhishDestroy. Continuous re‑scanning of the domain with VirusTotal or an equivalent multi‑engine scanner is recommended in case the site is re‑hosted. Organizations that employ brand‑specific email security should update spoofing detection rules to include vote‑base.club as a malicious sender. Incident response teams should treat any credential submissions associated with this domain as compromised and trigger appropriate credential reset procedures.