laurentlecuelle[.]com

The domain laurentlecuelle.com is currently active and is being used to impersonate Gmail for credential phishing. The site presents the page title "Laurent Lecuelle" and resolves to the Cloudflare‑managed IP address 104.21.86.16, which is associated with AS13335 in the United States. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating that TLS termination occurs at the CDN layer rather than the origin server. Technical fingerprinting shows the presence of Bootstrap, Slick, jQuery, and HTTP/3, all delivered via Cloudflare's infrastructure, and the domain is hosted on nameservers linda.ns.cloudflare.com and sullivan.ns.cloudflare.com. The domain was registered on May 23, 2023 through NameCheap, Inc., and carries a Gridinsoft trust score of 0/100. It appears on one security blocklist, has been flagged by PhishDestroy, and one of ninety‑five VirusTotal scanners has reported it as malicious. While the exact content of the landing page has not been inspected, the combination of a Gmail impersonation claim, credential phishing classification, and the observed infrastructure suggests a high‑risk threat. Defenders should block the domain at the DNS and proxy layers, monitor outbound traffic for connections to 104.21.86.16, and enforce multi‑factor authentication for Gmail accounts to mitigate credential compromise. Continued surveillance of the domain's registration and any changes to its hosting configuration is recommended, as attackers may pivot to alternate IPs or alter the front‑end assets while retaining the same domain registration.