vote-berachain[.]com

The domain vote-berachain.com was registered on September 29, 2025 through NiceNIC International Group Co., Limited and is currently listed as taken offline. DNS resolution points to 172.67.145.120, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The authoritative nameservers are kianchau.ns.cloudflare.com and meilani.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No SSL certificate is presented, and the HTTP response does not include HTTPS redirection, which is atypical for legitimate brand portals.

The site’s HTML title reads “Un instant…”, offering no direct reference to the targeted brand. The infrastructure is flagged by two of ninety‑five security engines on VirusTotal, and it appears on a single external blocklist, where PhishDestroy has recorded the domain as a brand‑impersonation threat. Independent analysis by Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment.

The primary uncertainty lies in the content that was hosted before the takedown; the page title provides no insight into the specific lures or credential‑collection mechanisms employed. Defenders should continue to block the domain at network perimeter devices, enforce DNS sink‑holing for the associated IP range, and monitor for any resurgence of the host under alternative subdomains or IP addresses. Threat‑intel teams should update internal watchlists to include the registrar and nameserver pair, and consider sharing the indicator set with industry‑wide blocklists to improve early detection of similar Cloudflare‑based impersonation campaigns.