goat502[.]digital

The domain goat502.digital was identified as engaging in brand impersonation specifically targeting Google. Although the site presented itself as a legitimate web design business called GOAT502 Digital, the underlying threat involved mimicking Google's brand to deceive users. No specific crypto drainer kit was detected, but the impersonation risk remains significant. The domain was registered through Cloudflare, Inc., and its SSL certificate was issued by Let's Encrypt (R13). VirusTotal flagged the domain with 2 out of 95 security vendors, and it appeared on two security blocklists. The domain resolved to IP address 216.198.79.1, was created on November 17, 2025, and as of this writing it has not been listed on Google Safe Browsing (GSB) but given the elevated risk level, continued monitoring is advised.

The domain is currently offline, indicating that takedown actions have been initiated. PhishDestroy recommends that organizations block any traffic to goat502.digital and its associated IP, and review logs for any previous interactions. Users who may have visited the site should be alerted to the impersonation risk and advised to change any credentials that might have been inadvertently shared. While the immediate threat is mitigated, the domain's short lifespan and impersonation of a high-value brand like Google suggest that similar domains may appear in the future, warranting proactive monitoring.