fakebill[.]us

Analysis of the domain fakebill.us, created on November 24, 2025 and currently active, shows a high‑risk brand‑impersonation campaign targeting Google users. The site resolves to the Cloudflare‑managed address 172.67.129.108, located in the United States and announced under ASN 13335 (Cloudflare, Inc.). DNS resolution is served by kim.ns.cloudflare.com and pablo.ns.cloudflare.com, indicating the use of Cloudflare’s proxy and DDoS mitigation services. The TLS certificate presented is issued by Google Trust Services under the WE1 label, which may be intended to lend legitimacy to the page but does not imply any affiliation with the legitimate Google infrastructure. HTTP requests return a 200 status code, and the page title "fakebill | Đăng Nhập Hệ Thống | Web Fakebill tự động" is observed, confirming the presence of a login‑oriented interface in Vietnamese.

Detected front‑end components include PHP, Bootstrap, SweetAlert2, jsDelivr, jQuery, and HTTP/3, all typical of modern phishing kits. The domain has been listed on one security blocklist and is flagged by PhishDestroy as a malicious site. VirusTotal analysis reports a single positive detection out of 95 scanners, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of benign reputation.

The campaign is classified as a tech‑support scam, with the impersonated brand explicitly identified as Google. While the exact phishing payload and credential harvesting mechanisms have not been publicly disclosed, the combination of brand impersonation, a legitimate‑looking TLS certificate, and known phishing infrastructure suggests a concerted effort to deceive users into providing Google‑related credentials. Defenders should block the domain at network perimeters, update URL filtering policies to include fakebill.us, monitor outbound connections to the associated Cloudflare IP, and educate users about unsolicited tech‑support requests that reference Google services.