s2-asi[.]com
“Google”
Ringkasan bukti
Analysis of s2-asi.com indicates a newly registered domain (19 Nov 2025) that is currently offline but was previously identified as a brand‑impersonation site targeting Google. The domain was registered via Dynadot LLC and configured to use Cloudflare’s DNS service, with the authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. Network resolution points to IP 216.58.206.68, an address owned by Google LLC (AS15169) and geolocated in Germany, suggesting the attacker deliberately pointed the domain to a legitimate Google server or leveraged a misconfiguration to obscure hosting details. The TLS certificate presented on the host is issued by Google Trust Services under the “WE1” profile, a certificate normally reserved for Google‑owned services, further reinforcing the intent to masquerade as an authentic Google endpoint.
HTTP probing returned a 404 status code, and the only visible page metadata is a title of “Google”. The site was flagged by two of ninety‑five VirusTotal scanners and is listed on a single external blocklist, where PhishDestroy has already taken action to block it. No additional detection sources such as Safe Browsing or OTX are cited in the available intelligence, and the content of the page has not been captured, leaving the exact phishing vector uncertain.
Given the combination of brand‑specific page title, legitimate‑looking SSL certificate, and the use of Cloudflare’s infrastructure, defenders should treat s2-asi.com as a high‑confidence impersonation threat. Recommended mitigation steps include adding the domain to DNS and web‑filter blocklists, monitoring the associated IP address for any resurgence of activity, and reviewing inbound traffic for attempts to reach the domain before it went offline. Continuous observation of newly registered domains that resolve to known corporate IP ranges and employ brand‑matching TLS certificates is advised to detect similar campaigns early.
Data Coverage
Alur Tanggapan Ancaman Pipeline
Cakupan daftar blokir
10 sumber eksternal dipantau · snapshot tersimpan 11/08/2026
Linimasa deteksi
-
Status domain
Dapat dijangkau → Tidak dapat dijangkau
-
Status domain
Dapat dijangkau → Tidak dapat dijangkau
-
Cloudflare Radar
Pemindaian Cloudflare Radar tersimpan · Buka pemindaian
-
Status domain
Tidak dapat dijangkau → Dapat dijangkau
Tangkapan tersimpan
Intelijen Domain
Detail teknisDNS, nama TLS, dan stempel waktu
ICANN OVERSIGHT
Akreditasi dan konteks RAA
Akreditasi dan konteks RAA
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Analisis VirusTotal
Apakah Anda Terpengaruh oleh Situs Ini?
Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.
Laporkan kepada Pihak Berwenang di Daerah Anda
Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.
Periksa Domain Apa Pun
Analisis ancaman menggunakan daftar blokir yang disimpan, WHOIS, DNS, dan bukti pemindaian publik
Pindai SekarangLaporkan Phishing
Laporkan domain yang mencurigakan ke basis data ancaman kami — lindungi komunitas
LaporanPemberitahuan Ancaman Real-Time
Laporan phishing terbaru dan perubahan ketersediaan yang diamati
PantauTetap Terinformasi, Tetap Aman
Pantau ancaman secara langsung atau ajukan keberatan terhadap daftar ini jika Anda yakin ini merupakan false positive