ldtlukioni[.]ge

Analysis of ldtlukioni.ge, registered on 5 May 2025 through atakdomain.com, shows infrastructure consistent with a low‑cost hosting provider. The domain resolves to 107.173.193.235, an address belonging to HostPapa (AS36352) located in the United States. No TLS certificate is presented, meaning all traffic is unencrypted HTTP/3 over LiteSpeed. Detected front‑end libraries include Bootstrap, jQuery, jQuery UI, FancyBox and Popper, indicating a generic web template rather than a sophisticated phishing front end. The page title advertised is “Home | LDT Lukioni Refinery, oil and gas refinery, Georgia refineries, reliable refineries, petroleum refinery,” which bears no obvious connection to the claimed target brand, Google.

Nevertheless, the domain is catalogued as a brand‑impersonation case targeting Google, and it has been added to the PhishDestroy blocklist and to one additional security blocklist. VirusTotal analysis reports a single positive detection out of ninety‑five scanners, confirming at least one vendor flagged the site as malicious. The domain is currently offline, limiting immediate observation of any credential‑harvesting pages. Uncertainty remains regarding the specific payload or credential‑capture mechanism, as no content beyond the title has been captured.

Defenders should continue to monitor the IP address and associated nameservers (dns3.fimgohost.com, dns4.fimgohost.com) for re‑use, enforce URL filtering for the exact host, and ensure that any user‑agent attempting to resolve the domain is blocked at the network perimeter. Because the site lacks HTTPS, any attempted connection would be exposed to passive network inspection, allowing detection of future activity. Maintaining the blocklist entry and sharing the indicator with threat‑intel platforms will help prevent resurgence. Until the domain reappears, the risk is elevated but mitigated by its offline status and existing blocklist coverage.