ricone[.]org

This domain, ricone.org, was observed hosting a brand‑impersonation page titled “Google Resource Hub”. The site resolved to the IPv4 address 142.250.184.243, which is owned by AS15169 Google LLC and is geographically located in the United States. Despite the legitimate‑looking hosting, the domain is registered through Amazon Registrar, Inc. and was created on 1 May 2015. The DNS configuration uses four Amazon Route 53 name servers (ns‑1876.awsdns-42.co.uk, ns‑294.awsdns-36.com, ns‑1336.awsdns‑39.org, and an incomplete fourth entry). MX records are present, pointing to Barracuda Networks (d304220a.ess.barracudanetworks.com) with priority 10 and an additional record with priority 15, indicating that the domain may have been used for email forwarding.

The SSL certificate presented on the site is identified as “R10”, a rating that suggests a low trust level. Threat intelligence platforms have flagged the domain as a brand‑impersonation of Google; one of ninety‑five VirusTotal scanners reported a detection, and the domain appears on a single security blocklist. It has been taken offline and is currently blocked by the PhishDestroy sink‑hole service. Gridinsoft’s trust score for the domain is 0 out of 100, reinforcing the malicious assessment. Analysis indicates that the infrastructure leverages a legitimate Google‑owned IP address to increase credibility, a technique commonly observed in sophisticated phishing campaigns.

The combination of a Google‑related page title, the use of Google‑owned hosting, and the low trust scores suggests an intentional attempt to deceive users seeking Google resources. However, the incomplete MX record data and the lack of publicly available sandbox or content analysis limit the ability to confirm the exact phishing payload or credential‑harvesting mechanisms employed. Defenders should continue to block ricone.