5birweb[.]com

This domain, 5birweb.com, is identified as a brand impersonation phishing site targeting Google. Analysis confirms its current status as offline, though it previously hosted content designed to deceive users into divulging credentials or sensitive information under the guise of a legitimate Google service. The page title, "الرئيسية - خبير ويب," suggests a focus on Arabic-speaking users, indicating a regionally targeted campaign. Infrastructure analysis reveals the domain was registered on October 02, 2024, through Global Domain Group LLC and resolves to the IP address 66.220.29.42, hosted under AS401742 (ServerOptima). The domain is flagged by 11 of 95 security vendors on VirusTotal, with one active blocklist entry. Its SSL certificate, issued by Let's Encrypt (R12), is a common tactic among phishing sites to mimic legitimacy. The detection count and blocklist presence underscore its elevated risk profile. As of the latest assessment, 5birweb.com has been taken offline, though residual threats may persist for users who previously interacted with the site. Organizations and individuals are advised to block the domain and associated IP (66.220.29.42) at the network level. Users should verify the authenticity of any Google-related login pages by checking the URL for official domains (e.g., google.com) and enabling multi-factor authentication. Security teams are encouraged to monitor for related domains registered through the same registrar (Global Domain Group LLC) or resolving to the same IP range, as these may indicate follow-up campaigns.