gov-australia-center[.]com

This domain is flagged for elevated-risk brand impersonation targeting the Australian Government, specifically mimicking the myGov verification portal to facilitate credential theft. Analysis indicates the infrastructure was designed to deceive users into submitting sensitive login credentials under the guise of official government authentication processes. Infrastructure analysis reveals the domain was registered on December 08, 2025, through Global Domain Group LLC, a registrar frequently associated with high-risk registrations. It resolved to IP address 158.94.209.86, hosted on AS202412 (Omegatech LTD) in the Netherlands, a network segment with a history of abuse. The domain appears on one security blocklist and is flagged by 21 out of 95 security vendors on VirusTotal, indicating broad detection despite its recent creation. Notably, the domain lacked an SSL certificate, a critical red flag for credential harvesting sites, and was taken offline following detection by automated threat intelligence systems. Mitigation steps for this specific threat type include immediate validation of all myGov-related communications through official channels only. Organizations should implement domain monitoring to detect lookalike domains using permutations of government brand names and enforce strict SSL/TLS requirements for all authentication portals. End-users should be trained to inspect domain names for subtle misspellings or unusual top-level domains and verify the presence of a valid SSL certificate before entering credentials. Network-level blocking of the IP address 158.94.209.86 and domains registered through Global Domain Group LLC with similar patterns is recommended to prevent further exposure.