gdlkzo[.]lat

On 22 July 2026, the domain gdlkzo.lat was observed as an offline infrastructure component used for a Google‑impersonating tech support scam. The domain was registered on 21 February 2026 and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is identified as “WE1”, indicating that the site used a publicly available certificate rather than a brand‑specific credential. The only visible page title is a single period (“.”), suggesting that the content has been removed or was never populated before the takedown.

VirusTotal scanned the domain and recorded a single positive detection out of 93 security vendors, confirming at least one vendor flagged the site as malicious. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy filtering service. No additional evidence such as Safe Browsing verdicts, Open Threat Exchange entries, or registrar information is available in the current intelligence set. Because the infrastructure is now offline, immediate threat to end users is reduced, but the short lifespan and recent creation date indicate a rapid‑deployment model that could be reused with new domains.

Defenders should continue to monitor for recurrences of the same IP address, Cloudflare ASN, and certificate fingerprint, and update email and web gateway filters to block any future resolution of gdlkzo.lat or similar‑pattern domains. Adding the observed IP 188.114.97.3 to deny lists and ensuring that brand‑specific URL filtering for Google‑related tech‑support claims is enforced will help mitigate re‑use of this infrastructure. Ongoing vigilance is advised, especially for user reports of unsolicited Google tech‑support calls or messages that reference the domain.