deafblindtradingltd[.]com

Analysis of deafblindtradingltd.com indicates this domain was actively impersonating Google as part of a tech support scam. The domain was registered on July 11, 2025, through Atak Domain and resolved to IP 198.12.66.123, hosted on AS36352 (HostPapa) in the US. Nameservers were set to ns1.host-forest.com and ns2.host-forest.com, a pattern consistent with low-cost bulletproof hosting. The SSL certificate was issued by Let's Encrypt (R12), a common choice for malicious domains due to its free and automated issuance. HTTP/3 was detected, a protocol rarely used by legitimate small businesses but occasionally leveraged by threat actors to evade legacy network inspection.

The page title, 'Deafblind Trading Limited - As a firm, our sustained success is based on the ability of our people to be at their best,' does not align with Google's branding or typical support pages, suggesting an attempt to appear as a legitimate corporate entity while delivering scam content. The domain was flagged by one security blocklist and detected by one of 95 vendors on VirusTotal, indicating limited but confirmed malicious activity. PhishDestroy blocked the domain, further corroborating its fraudulent nature. As of July 24, 2026, the domain is offline, though defenders should treat its infrastructure as compromised.

The hosting provider (HostPapa) and registrar (Atak Domain) have historically been slow to respond to abuse reports, so residual risk may persist if the same IP or nameservers are reused. No evidence links this domain to a known phishing kit, but the tech support scam classification is supported by the brand impersonation of Google. Defenders should monitor for re-registration or DNS changes, particularly under the same nameservers or IP range. If observed in logs, this domain should be blocked at the network and endpoint levels, and any associated credentials or session tokens should be invalidated.