dood-doodles[.]app

Analysis of dood-doodles.app, observed as a brand‑impersonation site targeting Google, shows that the domain was created on 1 May 2025 through Web Commerce Communications Limited dba WebNic.cc. The site resolves to the IPv6 address 2607:f8b0:4006:824::2004, which belongs to AS15169 owned by Google LLC and is geolocated in the United States. The TLS certificate presented is identified only as “WR2”, providing no indication of extended validation or organization verification. The page title returned by the server is “Google”, matching the declared brand target and confirming the intent to masquerade as a legitimate Google service. Reputation signals are overwhelmingly negative.

Gridinsoft assigns a trust score of 0 / 100, and the domain appears on two independent security blocklists. VirusTotal scans have resulted in two of ninety‑three security vendors flagging the domain for malicious activity. Both PhishDestroy and ScamSniffer have listed the domain as blocked, reinforcing the assessment that it is employed for credential‑phishing attacks. The reported scam type is “Credential Phishing”, although the exact phishing payload or login page has not been captured in the available data.

Because the site is currently taken offline, active traffic cannot be measured, but the infrastructure details—Google‑owned IP range, a recent registration, a low‑trust SSL certificate, and multiple vendor detections—suggest a deliberate attempt to exploit the trust associated with Google’s network. Defenders should continue to block the domain at network perimeter and DNS layers, add the IPv6 address to deny‑list rules, and monitor for any re‑registration attempts. Threat‑intel feeds should be updated to reflect the brand‑impersonation classification, and security teams should advise users that any unsolicited request appearing to originate from Google and directing to dood‑doodles.app is malicious. Ongoing observation of the registrar (WebNic.