staticgtag[.]info

This domain, staticgtag.info, presents itself as a legitimate GDPR cookie consent solution under the false pretense of offering a "CookieLaw Plugin – Simple GDPR & Cookie Consent." Analysis indicates it is a phishing infrastructure designed to harvest user credentials, session tokens, or deploy malicious payloads under the guise of compliance tools. The site employs deceptive tactics, including a fabricated plugin interface, to exploit trust in regulatory compliance frameworks and trick visitors into disclosing sensitive information or executing harmful scripts. The threat is particularly insidious as it targets website administrators and end-users who may unknowingly integrate or interact with the fraudulent plugin, believing it to be a legitimate privacy tool. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with abusive registrations. It resolves to the IP address 172.67.205.207, a Cloudflare proxy endpoint, which is commonly exploited to obfuscate malicious origin servers. The domain is flagged by 10 out of 95 security vendors on VirusTotal, including detections for generic phishing and fraudulent activity. It appears on two independent security blocklists and is actively blocked by enterprise-grade threat intelligence platforms. The SSL certificate, issued by Google Trust Services, provides a false sense of security, as the domain itself remains inherently malicious despite encrypted connections. Technologies detected include Node.js and Express, which are often leveraged in phishing kits for dynamic content generation and credential exfiltration. Users who have visited staticgtag.info or interacted with its content should take immediate corrective action. All credentials entered on the site must be considered compromised and should be reset across all platforms where identical or similar passwords were used. If the domain was accessed in a corporate or production environment, incident response protocols should be initiated, including network traffic analysis for connections to 172.67.205.207 and review of browser artifacts such as cookies, local storage, or cached scripts. System scans using updated endpoint protection tools are recommended to detect potential secondary infections. Website administrators should audit their codebases for any references to staticgtag.info or the alleged "CookieLaw Plugin" and remove all integrations immediately. Given the elevated risk level and the domain's current offline status, vigilance is advised, as threat actors may reactivate the infrastructure or deploy successor domains with similar naming conventions.