s2-mogcoin[.]xyz

Analysis indicates that s2-mogcoin.xyz was registered through Dynadot LLC on 19 November 2025 and is currently taken offline. The domain resolves to the IPv6 address 2a00:1450:4001:810::2004, which belongs to AS15169 Google LLC located in Germany. Despite the legitimate‑looking Google‑issued SSL certificate (Google Trust Services / WE1), the site presents the page title “Google” and returns an HTTP 404 status, suggesting that the malicious landing page has been removed. The infrastructure is protected by Cloudflare and serves HTTP/3, and the authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com.

Detection data show that seven of ninety‑five VirusTotal scanners flagged the domain, and it appears on one external blocklist. PhishDestroy also listed the domain, confirming its classification as a brand‑impersonation campaign targeting Gmail users. The Gridinsoft trust score of zero reinforces the malicious assessment. The combination of a Google‑issued certificate, Google‑owned IP address, and Cloudflare front‑end is indicative of abuse of trusted services to increase credibility.

Defenders should continue to block the domain at network perimeter and DNS layers, verify that no active content remains, and monitor for any resurgence of the host or similar domains registered with the same registrar or employing the same nameservers. Ongoing observation of VirusTotal and blocklist updates is recommended to capture any new detections. The evidence suggests a short‑lived impersonation attempt that has been taken offline, but the underlying technique of leveraging reputable infrastructure remains a persistent risk.