rwa-ondo[.]com

The domain rwa-ondo.com was taken offline as of the report date. Registration was performed through Dynadot LLC on 19 November 2025. The authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating that the domain leveraged Cloudflare’s DNS and CDN services. Network analysis shows the domain resolves to 142.251.35.164, an address owned by Google LLC (AS15169) located in the United States. The TLS handshake presents a certificate issued by Google Trust Services under the WE1 leaf, which further aligns the certificate chain with Google’s own PKI.

HTTP probing returned a 404 status code, and the page title reported by the scanner is “Google”, matching the declared brand target. The domain is listed on a single security blocklist and has been blocked by the PhishDestroy mitigation service. VirusTotal scans flagged the domain by 2 of 95 AV engines, providing limited but concrete malicious indicator coverage. The combination of a Google‑issued certificate, a Google‑owned IP address, and a page title that mirrors the target brand suggests intentional brand impersonation.

However, the site’s content could not be captured because the host returned a 404 and the domain is offline, leaving the exact payload and phishing kit unknown. Defenders should continue to monitor the domain for any re‑activation, ensure that the associated IP address is added to relevant blocklists, and consider extending protection rules for DNS queries to the Cloudflare name servers observed. The presence on PhishDestroy and the two VirusTotal detections provide actionable intelligence for automated block‑list feeds. Until the domain reappears, the current evidence supports an elevated risk rating for brand impersonation targeting Google users.