governance-rocketpool[.]xyz

The domain governance-rocketpool.xyz was registered through Dynadot LLC on 19 November 2025. DNS resolution points to 142.250.181.228, an address owned by AS15169 Google LLC in the United States, and the domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. No TLS certificate is presented, and the observed page title is simply “Google”, matching the declared target brand. A Gridinsoft trust score of 0 / 100 classifies the site as highly untrusted.

VirusTotal analysis shows that seven of ninety‑five scanned engines flagged the domain, indicating malicious characteristics. The domain appears on one external security blocklist and has been actively blocked by PhishDestroy. The recorded scam type is “Brand Impersonation” of Google, and the current operational status is offline, confirming that the site is no longer reachable. Evidence confirms that the domain was created less than a year ago, uses Cloudflare infrastructure, and lacks HTTPS, all of which are consistent with typical brand‑impersonation campaigns.

However, the absence of a visible SSL certificate and the fact that the IP belongs to Google’s own network raise uncertainty about whether the site ever hosted malicious payloads or relied on a temporary redirect. Defenders should proactively add governance-rocketpool.xyz to URL filtering and DNS blocklists, monitor for any re‑registration or similar domain patterns, and ensure that endpoint protection solutions incorporate the VirusTotal detections. Continuous review of Cloudflare‑hosted domains targeting the Google brand is advised, as attackers frequently recycle infrastructure to bypass existing mitigations.