epinefortune[.]com

Analysis indicates that epinefortune.com was registered on May 12, 2025 through Dynadot LLC and is presently marked as offline. The domain presents a page title identical to the URL, “epinefortune.com”, and is flagged as impersonating Google. The site employed a Let’s Encrypt R12 certificate, which is typical for encrypted web services but does not mitigate the impersonation risk. Network resolution points to IP address 107.172.61.186, which belongs to AS36352 operated by HostPapa in the United States.

The same IP host is associated with at least one security blocklist, and the domain itself appears on a single known blocklist. VirusTotal analysis shows that three out of ninety‑five scanning engines reported a malicious verdict, confirming that a subset of security vendors consider the domain malicious. The domain has been added to the PhishDestroy blocklist, indicating that a sink‑hole or takedown action has taken the site offline.

The limited visibility of the page content prevents confirmation of the exact phishing page design, login capture mechanisms, or payload delivery, so the precise attack vector remains uncertain. Defenders should continue to block the domain and its resolving IP at the network perimeter, update URL filtering policies to include the domain, and monitor for any re‑registration attempts or similar domains using the same registrar or hosting provider. Ongoing telemetry from security vendors should be reviewed for additional detections, and any future sightings should be correlated with the Google brand impersonation indicator set for this indicator set.