app[.]xn--defillma-n8a[.]com

app.xn--defillma-n8a.com was observed hosting a page whose title resolves to “Google”, matching the declared brand target of Google. The domain was registered on 3 December 2025 through Dynadot LLC and uses Cloudflare nameservers dalary.ns.cloudflare.com and steven.ns.cloudflare.com. DNS resolution points to IP 142.250.185.100, which belongs to AS15169 Google LLC located in the United States. The site returns HTTP 200 and does not present an SSL certificate, indicating an unencrypted service.

Four of ninety‑three VirusTotal scanners flagged the domain as malicious, and it appears on a single security blocklist. The domain has been taken offline by the PhishDestroy sinkhole, and the intelligence record assigns an elevated risk level while marking the current status as offline. The unique seed d90ea8 links this observation to related artifacts in the investigation pipeline. Because the domain resolves to a Google‑owned IP, generic reputation services may assign a false sense of trust, highlighting the need for contextual analysis that incorporates registration age, lack of TLS, and the crypto‑scam classification.

The label suggests attempts to lure victims into transferring digital assets, though no payload or page content has been captured. Defenders should block the domain and its associated IP, monitor for additional sub‑domains that resolve to the same IP range, and add the Cloudflare nameservers to watchlists for future registrations. Continuous re‑scanning after any re‑appearance is recommended to capture evolving malicious content.