mentalmask[.]xyz

Analysis indicates mentalmask.xyz was registered on December 05, 2024 through OwnRegistrar, Inc. and remains active on July 12, 2026. The domain resolves to IP address 192.3.190.186 with nameservers dns1.webproserver.com and dns2.webproserver.com. SSL certificate is issued by GoDaddy.com, Inc. under Go Daddy Secure Certificate Authority - G2. MX records consist of a single empty host entry with priority 0. The page title Mental Mask – Safe investment with Mental Mask is recorded alongside explicit brand target Google and scam type Impersonation.

Infrastructure analysis reveals technologies Node.js, Envoy, Express, HSTS and Akamai. The IP is located in the United States under AS36352 HostPapa. Gridinsoft trust score stands at 0/100. VirusTotal detection registers 2 out of 95 security vendors. The domain appears on exactly one security blocklist and is already blocked by PhishDestroy. HTTP status code returned is 200.

The registration age of approximately nineteen months combined with ongoing resolution and low but non-zero detection counts constitutes the primary observable evidence. Exact site content beyond the recorded page title has not been examined in available data. Brand impersonation targeting Google is documented directly in the intelligence set, while the investment-related phrasing in the title supplies the only additional classification detail.

Defenders should block the IP 192.3.190.186 and domain mentalmask.xyz at network and endpoint layers. DNS sinkholing of the listed nameservers is recommended where feasible. Continued monitoring of the single existing blocklist entry and periodic rechecking of VirusTotal results will track any change in detection volume. Organizations protecting the Google brand should incorporate the domain into internal threat feeds for immediate filtering.