gclid-id-ads-track[.]com

Analysis indicates that the domain gclid-id-ads-track.com was registered on 2026-08-02 through Dominet (HK) Limited and immediately pointed at the Cloudflare nameservers anna.ns.cloudflare.com and clayton.ns.cloudflare.com. DNS resolution returns the address 188.114.96.3, which belongs to the Cloudflare network and is commonly used by threat actors to hide the true hosting location. The domain has been added to at least one public blocklist and is currently listed as blocked by the PhishDestroy feed, confirming that defensive organizations have observed malicious activity associated with it. VirusTotal records show that the domain was examined by 91 scanning engines, none of which raised a detection at the time of the scan; the absence of a positive result does not imply benign intent, especially given the domain’s categorization as a generic phishing site in internal intelligence.

No public information about the site’s HTTP response, TLS certificate, page title, or the specific brand being spoofed is available. Consequently, the exact content and attack vector remain unknown. The lack of visible branding or page metadata limits the ability to attribute the campaign to a particular target, but the naming pattern—including the “gclid” token—suggests an attempt to lure users familiar with Google Click Identifier parameters, potentially indicating a credential‑harvesting campaign aimed at advertising platforms. Defenders should add the domain to internal block lists, enforce DNS sink‑holing for the address 188.114.96.3, and monitor outbound traffic for connections to Cloudflare‑hosted IP ranges that are not part of legitimate business services.

Email gateways should be tuned to flag messages that contain URLs or links referencing gclid-id-ads-track.com, especially when combined with language about ad tracking or click‑through metrics.