brigsulltra[.]com

Analysis of brigsulltra.com, created on March 12, 2025, shows a clear pattern of brand impersonation targeting Google. The domain is registered through NameCheap, Inc. and uses the host‑forest.com nameservers (ns1.host-forest.com and ns2.host-forest.com). No SSL certificate is present, indicating the site was served over plain HTTP. The page title retrieved from the live host reads "Welcome to | Brigsulltra," which does not contain the Google brand but the intelligence explicitly flags the domain as impersonating Google. Infrastructure analysis reveals the domain resolves to IP address 198.12.66.123, an address allocated to HostPapa (AS36352) in the United States.

The IP is currently listed on a single security blocklist and has been blocked by the PhishDestroy mitigation service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. VirusTotal scanning shows that one of ninety‑five security vendors flagged the domain, providing additional confirmation of malicious intent. The site is presently taken offline, but historical activity suggests it was used for brand‑impersonation campaigns.

Defenders should ensure that the domain and its resolving IP are added to outbound and inbound deny lists across firewalls, proxy devices, and email gateways. Continuous monitoring of the hosting provider (HostPapa) for new domains that share the same name server set or IP range is advisable, as threat actors often recycle infrastructure. Since the domain’s SSL configuration is absent, any future re‑activation would likely continue to lack encryption, making it easier to detect via TLS inspection rules. Organizations should also review any recent user reports of unsolicited communications referencing Google that could be linked to this domain, and apply URL filtering based on the known page title and registrar information.