arcipelagoarts[.]com

Analysis of arcipelagoarts.com, created on December 21, 2025 and currently taken offline, shows multiple indicators of a brand‑impersonation campaign targeting Google. The domain resolves to IP address 142.251.208.4, which is allocated to AS15169 Google LLC and located in the United States, suggesting the attacker deliberately leveraged a legitimate Google IP range to increase credibility. DNS resolution is served by Cloudflare nameservers aleena.ns.cloudflare.com and jake.ns.cloudflare.com, a common choice for fast‑changing malicious infrastructure. No SSL certificate is present, meaning any HTTPS connections would be rejected or would fall back to HTTP, a pattern often observed in hastily deployed impersonation sites.

VirusTotal reports that three of ninety‑three scanning engines flagged the domain, indicating that at least a subset of security products recognized malicious characteristics. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low credibility assessment. The page title returned by the server is simply "Google," matching the declared brand target and confirming the intent to masquerade as a Google resource. The domain appears on a single blocklist, specifically PhishDestroy, which has already taken action to block the domain for its phishing activity.

Registration details list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar, providing a traceable point of contact for takedown requests. While the site is presently offline, the combination of a legitimate Google‑owned IP, lack of TLS, low trust scores, and detection by multiple vendors suggests the domain was deployed for credential‑harvesting or other brand‑impersonation purposes. Defenders should continue to monitor DNS queries for the domain and its associated IP, enforce blocklist rules that include this indicator, and consider issuing sink‑hole redirects for any residual traffic.