securedconnection[.]2532890[.]com

Analysis of securedconnection.2532890.com shows a recently registered domain (created 21 February 2026) that is currently offline but was previously flagged for brand impersonation targeting Google. The domain resolves to 172.67.196.94, an address owned by Cloudflare, Inc. (AS13335) located in the United States. A TLS certificate labeled WE1 is present, indicating that HTTPS was enabled at the time of observation. VirusTotal records indicate that six of ninety‑three security vendors flagged the domain, suggesting a modest level of detection across the ecosystem.

The domain appears on one external security blocklist and has been explicitly blocked by PhishDestroy. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The page title returned from the HTTP response is "Mediplus - Free Medical and Doctor Directory HTML Template," which does not align with the advertised Google impersonation, implying that the content may have been swapped or that the site was used as a staging page for a tech‑support scam. The listed scam type is a Tech Support Scam, consistent with tactics that lure victims into believing they need assistance with Google services.

At present, no additional intelligence such as OTX tags, Safe Browsing status, or detailed payloads is available, leaving the exact phishing workflow uncertain. Defenders should continue to block the domain at perimeter filters, monitor outbound connections to the associated IP, and ensure that any user‑initiated contacts claiming to be from Google are verified through official channels. Threat intel feeds should be updated to include the domain and its associated indicators of compromise, and security teams should remain vigilant for similar sub‑domains under the 2532890.com zone that may be activated in the future.