freeregfstvl25[.]vpsinfoku25fstl20m1i[.]top

This domain, freeregfstvl25.vpsinfoku25fstl20m1i.top, was designed to impersonate Google’s customer support portal, likely to harvest user credentials or sensitive account information. The page displayed the title '𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔,' a tactic used to deceive users into believing they are interacting with legitimate Google services. Such impersonation schemes often employ urgency or fabricated account issues to trick victims into entering login details, payment information, or other personally identifiable data. Analysis indicates the domain was registered on December 10, 2025, through the registrar Cosmotown, a provider frequently associated with newly created malicious infrastructure. It resolved to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which is commonly used to obscure the true origin of phishing sites. The domain appeared on one security blocklist and was flagged by 17 out of 95 security vendors on VirusTotal, confirming its malicious classification. Notably, the site lacked an SSL certificate, a red flag for users accustomed to secure connections on legitimate platforms. If a user visited this domain or entered any information, immediate action is required. First, change passwords for any accounts accessed or entered on the site, prioritizing Google and email accounts. Enable multi-factor authentication where available to add an additional layer of security. Monitor financial statements and credit reports for unauthorized activity, as stolen credentials may be used for fraud. Users should also scan their devices for malware, as some phishing pages distribute malicious payloads. Finally, report the incident to relevant fraud reporting platforms to assist in tracking and mitigating further abuse of the infrastructure.