boxsafecapit[.]org

This domain, boxsafecapit.org, was observed as an offline infrastructure component associated with a Google brand‑impersonation campaign. The domain was registered on 21 July 2025 through OwnRegistrar, Inc., and resolves to the IPv4 address 176.9.7.179 hosted by Hetzner Online GmbH in Germany (AS24940). No TLS certificate was presented for the host, indicating that any web service would have been delivered over plain HTTP. The site’s HTML title, captured before takedown, reads “Home | Mobile Banking, Credit Cards, Mortgages, Auto Loan,” which does not reference Google but suggests a financial‑services façade.

The domain appears on a single security blocklist and has a Gridinsoft trust score of 0 / 100, reflecting a high confidence of malicious intent. VirusTotal analysis recorded detections from two of ninety‑five scanning engines, confirming that at least a subset of security products flagged the domain as suspicious. PhishDestroy has also listed the domain as blocked. The limited number of nameservers (one) and the absence of an SSL certificate reduce the surface for credential‑stealing but do not diminish the likelihood that the site was used to harvest Google account credentials or to host a credential‑phishing page.

Because the host is currently offline, active probing is not possible, and the exact phishing kit or page content remains unknown. Defenders should continue to block the associated IP range, enforce DNS sinkholing for the domain, and monitor for re‑registration attempts. Additional observation of traffic to the IP or any future resolution to new hosts would provide further context for the campaign’s lifecycle.