mun16[.]info

Analysis of the domain mun16.info indicates active brand impersonation targeting Google, specifically leveraging the Google Public DNS service as identified by the page title 'Google Public DNS.' The domain was registered on April 15, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar with a history of facilitating suspicious domains. Infrastructure analysis reveals the domain resolves to the IP address 172.67.206.182, which is associated with hosting providers commonly used for phishing campaigns. The domain is currently flagged on two security blocklists, PhishDestroy and BLP-Malware, and appears in 23 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition of its malicious nature. The domain employs a Let's Encrypt SSL certificate, a tactic frequently observed in phishing sites to create a false sense of legitimacy. Detection rates remain limited but notable, with 5 of 95 security vendors on VirusTotal identifying the domain as malicious. The domain's Gridinsoft trust score of 0/100 further corroborates its high-risk classification. Technologies detected include HSTS and HTTP/3, which may be used to enhance the perceived authenticity of the site or to evade basic detection mechanisms. As of July 12, 2026, mun16.info remains active, posing a continued threat to users who may be deceived into interacting with it under the guise of a legitimate Google service. Defenders are advised to block the domain at the network level and monitor for any attempts to access it within their environments. Given the domain's association with known phishing infrastructure and its presence on multiple threat intelligence platforms, organizations should treat this domain as a high-risk indicator of compromise. The exact content and functionality of the site have not yet been analyzed, but the available evidence strongly suggests malicious intent aligned with brand impersonation tactics.