hcdistrictclerk[.]lgbgl[.]vip

This domain, hcdistrictclerk.lgbgl.vip, was identified as a fake government login portal designed to impersonate official Harris County district clerk services. Analysis indicates the site operated as a brand impersonation phishing page, likely targeting users seeking legal or municipal documentation. The domain is currently offline, though prior activity suggests it may have been used to harvest credentials or distribute malicious payloads under the guise of legitimate government services. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Namemart Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 104.21.93.105 and was flagged by 10 of 95 security vendors on VirusTotal. The domain appeared on two independent security blocklists and was proactively blocked by multiple threat intelligence feeds. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing infrastructure. Creation date anomalies and registrar selection further support the assessment of malicious intent. The domain has since been taken offline, though residual risk remains for users who may have interacted with it during its operational window. Organizations are advised to block the domain and its associated IP at the perimeter, revoke any cached DNS entries, and conduct internal sweeps for connections to 104.21.93.105. Users who accessed the site should reset credentials for any accounts entered, particularly those tied to government or financial services. Monitoring for secondary infections or lateral movement is recommended, as phishing domains of this nature often serve as initial access vectors for broader compromise.