google[.]comunicazioni-sicure[.]it

This domain, google.comunicazioni-sicure.it, is identified as a high-risk brand impersonation phishing site. Analysis indicates the infrastructure was specifically designed to mimic Google's secure communications portal, likely to harvest credentials or distribute malware under the guise of legitimate corporate messaging. The domain does not appear to be associated with any known crypto drainer kits, focusing instead on credential theft through brand deception. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered through Aruba s.p.a. on October 05, 2023, and resolves to IP address 198.18.1.191, hosted on Amazon.com, Inc. infrastructure (AS16509) in Ireland. Google Safe Browsing flags this domain as phishing, while VirusTotal reports 18 out of 95 security vendors detecting malicious activity. The domain appears on two security blocklists (PhishDestroy and PhishingDB) and uses a Sectigo Limited SSL certificate (Sectigo Public Server Authentication CA DV R3) to create a false sense of legitimacy. As of the latest verification, google.comunicazioni-sicure.it has been taken offline, likely following abuse reports or hosting provider intervention. However, the remaining risk persists due to the domain's recent creation date and the potential for threat actors to re-establish infrastructure under similar naming conventions. Organizations should monitor for related domains using the same brand impersonation pattern (e.g., 'comunicazioni-sicure' subdomains) and update security controls to block lookalike domains. Users who may have interacted with this domain should immediately reset credentials and review account activity for unauthorized access.