base-voteg[.]rest

Analysis of base-voteg.rest, observed on 23 July 2026, indicates that the domain is currently offline but was previously associated with a brand‑impersonation campaign targeting Google. The domain was registered on 22 October 2025 through Web Commerce Communications Limited and resolves to the IP address 172.217.18.14, which belongs to AS15169 Google LLC located in the United States. The use of Google’s infrastructure for hosting suggests an attempt to lend credibility to the malicious content. The site presented the page title “Bevor Sie fortfahren”, a German phrase meaning “Before you continue”, and was classified as a crypto scam in intelligence reports. No TLS certificate was observed, meaning the site operated over plain HTTP, which is consistent with many low‑complexity scam pages.

Reputation data show the domain appears on a single security blocklist and is listed as blocked by PhishDestroy. VirusTotal scans recorded nine positive detections out of ninety‑five submitted security vendors, indicating that multiple AV engines identified the domain as malicious. Additional reputation metrics include a Gridinsoft trust score of 0 out of 100, reflecting a highly suspicious rating. The authoritative name servers are aitana.ns.cloudflare.com and kevin.ns.cloudflare.com, both hosted by Cloudflare, a common choice for fast‑flux or disposable infrastructure. The evidence confirms impersonation of Google, but the exact content of the page, including any credential‑harvesting forms or payment prompts, has not been captured.

Consequently, the precise attack vector remains uncertain. Defenders should continue to block base‑voteg.rest at the DNS and network layers, monitor for any re‑activation of the domain, and consider adding the domain to internal blocklists. Organizations using Google services should reinforce user awareness training, emphasizing that legitimate Google communications will always be delivered over HTTPS and will not request cryptocurrency payments.