rangoexchange[.]co

This domain is flagged as an elevated-risk phishing infrastructure specifically designed for brand impersonation targeting Google. Analysis indicates the site was engineered to mimic legitimate Google services, leveraging psychological manipulation to harvest credentials or deploy malware under the guise of trusted authentication processes. Infrastructure analysis reveals the domain rangoexchange.co was registered on July 14, 2025, through Dynadot LLC. It resolves to the IP address 142.250.186.164 and employs technologies including reCAPTCHA and HTTP/3, which may be used to evade automated detection systems. The page title explicitly displays 'Google,' reinforcing the impersonation attempt. Security vendor assessments on VirusTotal flag the domain as malicious by 4 out of 95 engines, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently offline, though historical activity remains a concern. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing pages. Mitigation against this threat type requires multi-layered defenses. Network administrators should implement DNS filtering to block known malicious domains, including this one, at the perimeter. Endpoint protection systems should be configured to detect and prevent access to domains registered within the past 30 days that impersonate high-value brands. Users should be trained to scrutinize domain names, particularly those mimicking Google, and verify SSL certificates through browser security indicators. Organizations should also monitor for internal traffic to newly registered domains resolving to IP ranges associated with known phishing infrastructure, such as 142.250.186.164. In cases where exposure is suspected, immediate credential rotation and system scans for unauthorized access are recommended.