bxgwf[.]com

This domain is flagged as an active phishing site specializing in brand impersonation, specifically targeting Google. Analysis indicates the threat type aligns with credential harvesting and fraudulent authentication portals, leveraging the trust associated with the Google brand to deceive users into disclosing sensitive information. Infrastructure analysis reveals the domain bxgwf.com resolves to the IP address 188.114.97.3 and was registered through Gname.com Pte. Ltd. on November 11, 2014. Despite its long-standing registration, the domain has evaded detection on major blocklists, with a VirusTotal score of 0/95. The site employs Google Web Server technology, HSTS, and HTTP/3, alongside a Google Trust Services SSL certificate, further mimicking legitimate Google infrastructure. No entries were found on prominent threat intelligence feeds at the time of analysis, suggesting either recent activation or sophisticated evasion techniques. Mitigation measures for this specific threat type include immediate blocklisting of the domain and associated IP address 188.114.97.3 across enterprise and consumer security controls. Network administrators should prioritize monitoring for connections to this domain, particularly in environments where Google services are frequently accessed. End-users should be educated on verifying domain authenticity, especially when prompted for credentials, and encouraged to report suspicious login pages impersonating Google. Organizations are advised to implement multi-factor authentication and domain-based message authentication to reduce the risk of successful phishing attempts.