apphop[.]co

This domain, apphop.co, is identified as a brand impersonation phishing site targeting Google. Analysis confirms the domain was actively spoofing Google services, presenting a fraudulent interface to deceive users into disclosing credentials or sensitive information. As of the latest assessment, the domain has been taken offline, though prior activity remains under investigation. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 24, 2025, and resolved to the IP address 76.223.105.230. Detection metrics indicate zero flags from 95 VirusTotal vendors, suggesting the domain evaded automated detection at the time of registration. It appears on a single security blocklist and holds a trust score of 0/100, reinforcing its malicious classification. Technologies detected on the domain include GoDaddy Website Builder, RequireJS, reCAPTCHA, Re:amaze, and HSTS, alongside a GoDaddy-issued SSL certificate. The domain’s current offline status reduces immediate risk, though historical exposure may persist for users who interacted with it prior to takedown. Organizations are advised to block the domain and its associated IP (76.223.105.230) at the network perimeter. Endpoint protection should be updated to include apphop.co in denylists, and users should be alerted to verify domain authenticity before entering credentials. Monitoring for residual connections to the IP or related infrastructure is recommended, as threat actors may reuse components for future campaigns.