io-googlse[.]com[.]cn

PhishDestroy identifies an active brand impersonation campaign targeting Google users through the domain io-googlse.com.cn. This domain poses an elevated risk as a crypto drainer impersonating Google services. Users who interact with this domain risk unauthorized cryptocurrency transfers facilitated by deceptive login prompts or malicious smart contract interactions designed to drain connected wallets.

This domain was registered on April 07, 2026, through 厦门市中资源网络服务有限公司 and resolved to IP 172.67.140.109. It carries a Let's Encrypt SSL certificate and has been flagged by 1 out of 95 VirusTotal security vendors. Additionally, the domain appears on two security blocklists and is blocked by MetaMask and SEAL. Based on these indicators, the domain exhibits low trust and high malicious intent, specifically targeting users through false association with Google's brand to facilitate cryptocurrency theft.

To mitigate exposure to this threat, users must verify domain legitimacy before entering credentials or connecting wallets. Avoid clicking links from unsolicited emails or messages. Use PhishDestroy’s real-time verification tools to confirm domain safety. Organizations should update firewall and DNS blocklists to include io-googlse.com.cn and monitor network traffic for connections to 172.67.140.109. Exercise extreme caution with any site mimicking Google’s login or service pages, especially those requesting wallet connections or cryptocurrency transactions.