vote-tokensworks[.]net

PhishDestroy has identified vote-tokensworks.net as a confirmed phishing site engaged in brand impersonation of Google. The domain presents a fraudulent Google Account login page designed to harvest user credentials. The threat type is credential phishing, with no specific crypto drainer kit identified, but the deception is targeted at Google users.

The domain was created on November 11, 2025, registered through OwnRegistrar, Inc., and resolves to IP address 64.233.167.84. VirusTotal analysis shows 3 out of 95 security vendors flag this domain as malicious. It appears on 2 security blocklists and was not listed on Google Safe Browsing (GSB) at the time of analysis. The SSL certificate is issued by Google Trust Services for WE1, adding a layer of false legitimacy. The page title "Anmelden – Google Konten" indicates a German-language Google account login page, targeting German-speaking users.

Currently, vote-tokensworks.net is offline, suggesting that either the hosting provider or registrar has taken action in response to reports. However, the domain may be reactivated or use redirection. Users are advised to never enter credentials on such sites and always verify URLs directly. PhishDestroy recommends checking any suspicious URLs before login and enabling multi-factor authentication as a safety measure against credential theft. Remaining risk includes potential reactivation or similar domains registered by the same threat actor.