login[.]clgdsfghgfhjjiihgfcdss[.]xyz

The domain login.clgdsfghgfhjjiihgfcdss.xyz was registered on October 29, 2025 through NameCheap, Inc. and is currently listed as offline. DNS resolution points to the IP address 142.250.181.228, which belongs to AS15169 (Google LLC) and is geolocated in the United States. The authoritative nameservers are frank.ns.cloudflare.com and lilyana.ns.cloudflare.com, indicating that the domain is hosted on Cloudflare's infrastructure. No SSL certificate is presented for the site, meaning the HTTP endpoint operates without Transport Layer Security.

The page title returned by the server is "Google," and the threat type is recorded as brand impersonation targeting Google, confirming that the domain attempts to masquerade as a legitimate Google login portal. Google Safe Browsing classifies the URL as a social engineering threat, and the domain appears on a single security blocklist. VirusTotal analysis shows that 14 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of malicious intent. The domain has been blocked by the PhishDestroy service, which further indicates that it was actively used in phishing campaigns before being taken offline.

While the underlying IP belongs to Google’s network, the lack of a valid TLS certificate, the deceptive page title, and the detection metrics collectively suggest a deliberate attempt to harvest credentials. Defenders should continue to monitor for any resurgence of the domain, ensure that any inbound traffic to the IP is inspected for credential harvesting payloads, and update web filtering policies to block the domain and its associated IP. Organizations using Google services should reaffirm the use of official login URLs and educate users about the absence of TLS on this domain.