curvemodernforester[.]com

Analysis of curvemodernforester.com indicates an active credential‑phishing campaign targeting Google users. The domain was created on 18 December 2025 via ENOM, INC. and resolves to 216.58.206.68, an IP address owned by AS15169 Google LLC in Germany, suggesting the attacker is leveraging legitimate Google infrastructure to increase perceived trust. The site returns an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (R12), which provides no brand validation.

The page title reported by scanners is “Google”, matching the declared brand target, and the threat is classified as brand impersonation with a high risk rating, remaining active as of 25 July 2026. Seven of ninety‑three VirusTotal vendors flag the domain as malicious, while Gridinsoft assigns a trust score of 0 / 100. The domain appears on a single security blocklist and is already blocked by PhishDestroy. Nameservers ns1.publicdnsservice.com and ns2.publicdnsservice.com are publicly accessible and have been associated with other malicious hosts.

Technologies detected include Google Web Server, HSTS, and HTTP/3. The available evidence confirms a high‑risk impersonation of Google for credential harvesting, but the exact phishing payload, drop‑off pages, and credential collection mechanisms have not been disclosed beyond the title. Defenders should add curvemodernforester.com to blocklists, enforce strict domain‑based allow‑lists for Google services, monitor DNS queries for the associated nameservers, and flag any TLS connections to the Let’s Encrypt certificate for further inspection. Continuous re‑scanning with multi‑vendor engines is recommended to capture any evolution of the threat.