vote-bases[.]club

Analysis of vote-bases.club indicates a confirmed brand impersonation operation targeting Google, with infrastructure designed to mimic Google News. The domain was registered on February 21, 2026, through Dynadot LLC and configured with Cloudflare nameservers (kevin.ns.cloudflare.com and aitana.ns.cloudflare.com). Despite resolving to an IPv6 address (2607:f8b0:4004:c08::66) geolocated within Google LLC's autonomous system (AS15169), the hosting arrangement appears deceptive, as the domain lacks a valid SSL certificate and was flagged by 12 of 93 security vendors in VirusTotal scans. The page title, 'Google News,' directly aligns with the impersonation target, reinforcing the likelihood of fraudulent intent.

As of July 23, 2026, the domain is offline and blocked by PhishDestroy, though its prior activity remains under scrutiny. Infrastructure analysis reveals reliance on Cloudflare for DNS management, a common tactic to obscure hosting origins and evade detection. The absence of SSL encryption further suggests a low-effort or short-lived campaign, as modern phishing sites typically deploy certificates to appear legitimate.

While the domain's creation date is recent, its rapid inclusion on a security blocklist and vendor detections indicate swift identification by threat intelligence systems. Defenders should treat this domain as a confirmed threat vector, particularly for users encountering Google News-themed lures. No evidence of a phishing kit or additional payloads has been confirmed, but the domain's alignment with Google's branding warrants continued monitoring for resurgence or related infrastructure.