mail[.]google[.]oscarmar[.]com

This domain is classified as a high-risk brand impersonation threat targeting Google users. Analysis indicates the site was designed to harvest credentials through fraudulent login pages, leveraging Google’s branding to deceive victims into submitting sensitive authentication details. The domain’s infrastructure and content align with known phishing tactics, including the use of subdomains to mimic legitimate services and evade detection. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on June 24, 2006, and resolves to the IP address 66.49.202.121, hosted on AS33139 (Canaca-com Inc.) in Canada. Security vendor assessments on VirusTotal flagged the domain as malicious, with 20 out of 95 engines detecting phishing-related activity. Google Safe Browsing also classified the site as phishing, and it appears on two security blocklists: PhishDestroy and PhishingDB. The page title, 'Index of /,' suggests an exposed directory structure, which is atypical for legitimate services and may indicate poor operational security or an abandoned phishing kit. The SSL certificate is issued by Let’s Encrypt (R13), a common choice for threat actors due to its free and automated issuance process. Despite its creation date in 2006, the domain’s recent malicious activity suggests it was either repurposed or compromised. Mitigation measures should focus on blocking the domain and its associated IP address across network security controls, including firewalls, email gateways, and endpoint protection systems. Organizations should update security blocklists to include mail.google.oscarmar.com and 66.49.202.121 to prevent access or redirection. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly Google-related services. Security teams should monitor for indicators of compromise, such as unusual login attempts or unauthorized access, and review logs for connections to the domain or IP. Additionally, domain registrars and hosting providers should be notified of the malicious activity to facilitate takedown or further investigation.