534245google[.]com

Domain 534245google.com was registered on July 5 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently served by Cloudflare nameservers angelina.ns.cloudflare.com and dale.ns.cloudflare.com. The site resolves to IP 104.21.37.106, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An SSL certificate issued by Google Trust Services (WE1) is presented, and the web server advertises HSTS, Cloudflare Browser Insights, and HTTP/3, giving the site a superficially legitimate appearance. The domain is listed on one public blocklist and has been flagged by PhishDestroy. VirusTotal reports five out of ninety‑five scanners labeling the host as malicious, and Gridinsoft assigns a trust score of 0 / 100. AlienVault OTX references the domain in two separate threat‑intel pulses, indicating that it has been observed in multiple campaigns. Despite these indicators, the site returns HTTP 200 responses, confirming that the fraudulent payload remains accessible. Analysis classifies 534245google.com as a high‑risk brand impersonation campaign targeting Google users. The combination of a recent registration date, a Cloudflare‑proxied infrastructure, and a legitimate‑looking certificate is typical of fast‑flux phishing operations designed to evade simple blacklist checks. The low detection count suggests that many security products have not yet incorporated this indicator, increasing exposure for organizations that rely on signature‑based defenses. Defenders should proactively block the domain at DNS and proxy layers, monitor outbound connections to the associated IP address, and incorporate the domain and its resolver IP into threat‑intel feeds. Continuous re‑evaluation is advised, as the infrastructure may shift to alternative Cloudflare edge nodes or adopt new registrars. Incident response teams should treat any credential submissions to this site as compromised and initiate credential‑reset procedures for affected Google accounts.