elevon-payment[.]com

This domain, elevon-payment.com, is actively impersonating Google to deceive users into disclosing sensitive information such as login credentials, payment details, or personal data. The site displays the page title 'YouTube,' a clear attempt to exploit the trust associated with Google's video-sharing platform. Brand impersonation of this nature is commonly used in phishing campaigns to trick users into believing they are interacting with a legitimate service, increasing the likelihood of successful fraud or account compromise. Analysis indicates this domain was registered on November 29, 2025, through MAT BAO CORPORATION, a registrar with a history of hosting suspicious domains. Security vendors have flagged elevon-payment.com as malicious, with 19 out of 95 engines on VirusTotal detecting it as a threat. The domain resolves to the IP address 142.250.186.174, which is geolocated in Mongolia and associated with AS15169, Google LLC. While the IP itself is part of Google's infrastructure, the domain is not authorized or affiliated with Google, and its SSL certificate, issued by Google Trust Services, further mimics legitimate Google properties to evade detection. If you have visited elevon-payment.com or interacted with its content, immediate action is required to mitigate potential risks. Disconnect the device from the network to prevent further data transmission. Run a full system scan using updated security tools to detect and remove any malware or unauthorized access. Reset passwords for any accounts accessed during the interaction, particularly those associated with Google services, and enable multi-factor authentication where available. Monitor financial statements and account activity for unauthorized transactions. Users should also report the domain to their organization's security team or relevant authorities to assist in broader threat mitigation efforts.