org-vote[.]rest

The domain org-vote.rest has been identified as a credential harvesting site specifically designed to impersonate Google. Analysis confirms this domain operated as a brand impersonation threat targeting user authentication credentials, currently marked as offline. Infrastructure analysis reveals the domain was registered through Dynadot, LLC on June 16, 2026, and resolved to the IP address 142.251.154.119. It utilized a Let's Encrypt SSL certificate to create a false sense of security. The domain appears on three security blocklists and was flagged by 6 of 95 security vendors on VirusTotal. Additional technical indicators include a Gridinsoft trust score of 0/100, the presence of HSTS and Google Analytics technologies, and HTTP/3 protocol usage. The page title was explicitly set to 'Google,' reinforcing the impersonation attempt. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, organizations should treat this domain as a confirmed malicious indicator. Recommended actions include adding org-vote.rest to internal blocklists, monitoring for related infrastructure reuse, and conducting user awareness training focused on recognizing credential harvesting tactics. Security teams should also review logs for any prior connections to 142.251.154.119 or related domains registered through Dynadot during the active period.