com-selfhelp[.]page

On July 22, 2026, analysis of the domain com-selfhelp.page identified it as a brand‑impersonation infrastructure targeting Google. The domain was registered through NiceNIC International Group Co., Limited and first seen on February 24, 2026. Its authoritative nameservers are ns3.my-ndns.com and ns4.my-ndns.com. DNS resolution points to IP address 142.250.186.68, which belongs to Autonomous System AS15169 owned by Google LLC and is geolocated in Germany. The hosting IP aligns with legitimate Google infrastructure, a tactic often used to increase credibility. The TLS certificate presented by the site is issued by Let’s Encrypt (R13), providing a valid HTTPS connection but offering no indication of malicious intent.

HTTP traffic is served over HTTP/3 and the page includes a reCAPTCHA challenge, which may be employed to deter automated analysis. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis shows that four of ninety‑three scanned scanners flagged the domain, confirming the presence of malicious indicators. The domain is listed on three commercial blocklists, specifically PhishDestroy, MetaMask, and SEAL, and these feeds have already marked it as malicious. The HTML title retrieved from the live site was the exact string “https://www.google.com/”, matching the brand target and reinforcing the impersonation claim.

While the site is currently offline, the combination of a Google‑related page title, use of a Google‑owned IP range, and presence on multiple blocklists suggests an intentional attempt to lure victims into believing the page is a legitimate Google login or service. No additional payload, credential‑harvesting form, or redirect behavior has been observed, leaving the exact attack vector undetermined. Defenders should immediately block DNS resolution for com-selfhelp.page at network perimeter and incorporate the domain into endpoint and proxy deny lists.