fetching287[.]live

fetching287.live was registered on May 21 2026 via NameSilo, LLC. The domain resolves to 188.114.96.3, an address owned by Cloudflare, Inc. in Canada. It is served over HTTPS using a Let’s Encrypt certificate (issuer E7) and the authoritative name servers are christian.ns.cloudflare.com and aleena.ns.cloudflare.com. An HTTP GET to the root URL returns a 403 Forbidden response, indicating that the site is deliberately restricting public access.

The domain is classified as a Google brand impersonation campaign. VirusTotal records show that 2 of 95 security vendors have flagged the domain as malicious, and the Gridinsoft trust score is 0 out of 100, both metrics pointing to high confidence of abuse. It appears in a single AlienVault OTX pulse and is listed on one external blocklist. PhishDestroy has also added the domain to its block list, confirming that it is actively used in phishing operations.

The internal risk rating is high and the operational status remains active. The combination of a recent creation date, Cloudflare front‑end, revoked public content (403), and multiple reputation signals suggests the domain is likely hosting credential‑stealing pages that mimic Google login flows or redirecting victims to compromised Google‑related services. Because the web server returns only a 403 response, the exact payload or landing page cannot be confirmed, leaving the precise malicious technique uncertain.

Defenders should block fetching287.live at perimeter firewalls and DNS resolvers, monitor for any outbound connections to the IP 188.114.96.3, and inspect TLS traffic for the Let’s Encrypt certificate fingerprint. Organizations should update email and web filtering rules to flag URLs containing the domain or any sub‑domains, and consider sinkholing the domain to disrupt command‑and‑control channels if further activity is observed. Continuous threat‑intel feeds should be queried for additional indicators of compromise related to this infrastructure.