royalapexcreditunion[.]com

royalapexcreditunion.com is a newly registered domain (created 16 April 2026) that claims to impersonate Google. The registration was performed through Sicherregister, LLC and the domain resolves to IP 107.172.61.186, which belongs to AS36352 HostPapa in the United States. The site serves content over HTTPS with an SSL certificate identified as R10, and the HTTP response code is 200, indicating a reachable web service. The page title returned by the server is “Welcome | Stalon Credits”, a title that does not reference Google and suggests a possible reuse of a generic credit‑related template. VirusTotal records a single positive detection out of 95 scanners, and Gridinsoft assigns a trust score of 0/100, both indicating strong malicious confidence. The domain is already listed on at least one security blocklist and has been blocked by the PhishDestroy service. Analysis of the observable infrastructure points to a classic tech‑support impersonation campaign. The combination of a high‑risk rating, active status, and the presence of a Google impersonation tag aligns with the reported scam type of “tech_support”. The hosting provider HostPapa is a known shared‑hosting environment often leveraged for rapid deployment of malicious sites, and the low trust score further confirms the likelihood of fraudulent activity. Defenders should add 107.172.61.186 to network deny lists, enforce DNS filtering for royalapexcreditunion.com, and monitor for outbound connections to the host. Email gateways should block messages that reference the domain or use Google‑related lure language. Continuous re‑scanning of the site is recommended, as additional detections may emerge as more scanners evaluate the payload.