google-finance-aibot[.]com

This domain, google-finance-aibot.com, is actively impersonating Google and is classified as a high-risk tech support scam. Registered on January 4, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, the domain resolves to IP 104.21.35.160, hosted on Cloudflare's infrastructure (AS13335). Nameservers javon.ns.cloudflare.com and zara.ns.cloudflare.com further confirm Cloudflare's role in its hosting. The SSL certificate, issued by Google Trust Services (WE1), may contribute to the appearance of legitimacy, though it does not validate the site's authenticity. Analysis indicates the domain is flagged by 13 of 93 security vendors on VirusTotal, with detections aligning to social engineering and brand impersonation. It appears on three security blocklists and is referenced in one AlienVault OTX threat intelligence pulse. Google Safe Browsing explicitly flags the domain for social engineering, reinforcing its malicious classification. The domain returns an HTTP 301 status, suggesting it may redirect visitors to another malicious endpoint, though the final destination remains unconfirmed. Defenders should treat this domain as actively hostile. The page title, 'google-finance-aibot.com,' directly mirrors the domain name, offering no additional context about the exact content or tactics employed. The scam type, identified as a tech support scam, typically involves fraudulent attempts to extract sensitive information or payments under the guise of technical assistance. Given the domain's age and continued activity, it is likely part of an ongoing campaign targeting users familiar with Google's financial or AI-related services. Organizations should block traffic to this domain at the network level and monitor for related infrastructure, particularly any domains leveraging similar naming conventions or Cloudflare-hosted IPs.