revoke-benqfi[.]com

This domain is currently under investigation for brand impersonation targeting Google, specifically designed to facilitate credential theft. Analysis indicates a high-risk profile due to its deceptive infrastructure, which mimics legitimate Google authentication portals. The page title, 'Inicia sesión: Cuentas de Google,' directly replicates Google’s login interface in Spanish, suggesting a targeted campaign aimed at Spanish-speaking users. While the domain has been taken offline, its prior activity and registration details warrant further scrutiny to prevent potential re-emergence or similar threats. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IPv6 address 2a00:1450:400c:c0c::54, a range associated with legitimate services but potentially abused for spoofing. It was registered on November 12, 2025, through OwnRegistrar, Inc., a registrar frequently observed in fraudulent domain registrations. VirusTotal reports 0 detections out of 95 engines, indicating the domain had not yet been widely flagged at the time of assessment. However, it appears on at least one security blocklist, and Gridinsoft assigns it a trust score of 0/100, reinforcing its suspicious nature. The domain’s creation date suggests it was established recently, aligning with common tactics for short-lived phishing campaigns. Mitigation steps for this type of threat focus on proactive monitoring and user education. Organizations should implement domain monitoring to detect newly registered domains impersonating their brand, particularly those using lookalike strings or typosquatting techniques. Network-level protections should block traffic to known malicious IPs, including the IPv6 address associated with this domain. End-users should be trained to verify domain authenticity before entering credentials, especially when encountering login pages in non-primary languages. Additionally, security teams should review logs for connections to the identified IP and domain, as well as any attempts to access the page title or URL patterns matching 'Inicia sesión: Cuentas de Google.' If the domain reappears, immediate takedown requests should be submitted to the registrar and hosting providers to disrupt further abuse.