his-examine-armor-nascar[.]trycloudflare[.]com

This domain, his-examine-armor-nascar.trycloudflare.com, was identified as part of a brand impersonation campaign targeting Google, as confirmed by its classification in Google Safe Browsing for social engineering. Infrastructure analysis reveals the domain was hosted via Cloudflare Tunnel, resolving to the IP address 104.16.230.132, which is associated with AS13335 (Cloudflare, Inc.) in the United States. The domain lacks traditional nameserver records, consistent with ephemeral Cloudflare Tunnel deployments designed to evade detection and takedown efforts. At the time of analysis, the domain was offline, though it remains unclear whether this was due to voluntary suspension, enforcement action, or infrastructure rotation.

SSL certificate data indicates the use of a Google Trust Services certificate (WE1), a detail that may have been leveraged to lend credibility to the impersonation attempt. Detection metrics from security vendors show limited but notable coverage: six of 91 vendors on VirusTotal flagged the domain, while it appears on at least one security blocklist. Gridinsoft assigned a trust score of 0/100, further supporting its malicious classification. No additional details regarding the specific phishing kit, lure content, or victim targeting are available at this time, as the exact page content was not analysed.

Defenders should treat this domain as a confirmed threat vector for Google brand impersonation. The use of Cloudflare Tunnel infrastructure suggests a preference for rapid deployment and evasion, a pattern observed in other high-velocity phishing campaigns. While the domain is currently offline, organisations should proactively block the domain and its resolved IP (104.16.230.132) at the network perimeter, as well as monitor for any re-emergence under similar subdomain patterns or Cloudflare Tunnel infrastructure.