xn--defillam-p8a[.]com

Analysis of xn--defillam-p8a.com indicates a credential‑phishing site that impersonates Google. The domain was registered on 10 May 2025 through Ultahost, Inc. and resolves to the IPv6 address 2a00:1450:4001:808::2004, which belongs to AS15169 operated by Google LLC and is geolocated in Germany. The TLS certificate presented is identified as "WE2", a pattern commonly observed in malicious deployments, and the site’s HTTP response returns a page titled "Google". Defensive feeds have flagged the domain: Gridinsoft assigns a trust score of 0 / 100, VirusTotal records seven detections out of ninety‑three scanners, PhishDestroy has blocked it, and it appears on one external blocklist. The domain is currently taken offline, limiting direct observation of its payload. The domain’s presence on a single security blocklist and the specific block by PhishDestroy reinforce its malicious classification.

The low trust score from Gridinsoft aligns with the detection pattern observed across multiple vendors. Although VirusTotal records seven positive detections, the modest number reflects limited scanning rather than benign behavior. The registration date of May 10 2025 places the domain well within the typical lifetime of abuse campaigns that leverage newly created punycode domains to evade automated filters. Defenders should immediately add the IPv6 address and the punycode domain to network deny lists, ensure URL filtering solutions ingest the domain from threat‑intel feeds, and monitor for future registrations that use similar Unicode homograph techniques targeting Google. Continuous correlation with DNS query logs and authentication attempts can reveal attempted credential harvests.

Because the site is not serving content, active probing is not required; however, repeated checks for re‑activation are advisable.