genesis-keeta[.]org

genesis-keeta.org was observed targeting the Google brand. The domain was registered on 19 November 2025 through Dynadot LLC and resolves to 172.217.18.4, an address owned by AS15169 Google LLC in the United States. DNS is served by Cloudflare (brenna.ns.cloudflare.com, hassan.ns.cloudflare.com) and the site advertised HTTP/3 support. An HTTPS handshake presented a certificate issued by Google Trust Services under the WE1 intermediate, indicating that a Google‑issued certificate was available for the domain at the time of analysis. The only visible HTML element returned a page title of “Google”, and the HTTP response code was 404, suggesting that the landing page was either removed or never deployed.

No phishing kit or login form has been captured, and the absence of substantive content prevents a definitive classification of the payload type. Threat‑intel aggregators have recorded the domain on a single security blocklist and PhishDestroy has actively blocked it. VirusTotal reports two detections out of ninety‑five scanners, confirming that at least a minority of AV engines consider the site malicious. The domain is currently listed as offline, and no further content has been captured. Analysis indicates that the combination of a Google‑related SSL certificate, Cloudflare front‑end, and a Google‑owned IP address is consistent with a credential‑harvesting campaign that attempts to lure victims by mimicking the Google brand.

However, the limited detection count and the absence of a reachable payload mean that the operational status of the infrastructure cannot be fully confirmed. Defenders should continue to monitor DNS resolutions for genesis‑keeta.org, enforce blocklists that include the domain, and consider adding the IP address 172.217.18.4 to network‑level deny lists only after correlating with other Google‑impersonation indicators to avoid false positives.