rp-google[.]com

Analysis of rp-google.com indicates active infrastructure supporting a high‑risk brand‑impersonation campaign targeting Google users. The domain resolves to IP address 209.99.184.226, which is registered to HostRoyale Technologies in Switzerland (CH). TLS is provided by a Let's Encrypt YR1 certificate, and HTTP requests return a 302 redirect, suggesting a possible credential‑harvesting landing page. Registration details show the domain was created through PDR Ltd. d/b/a PublicDomainRegistry.com, and authoritative DNS is served by orderbox‑dns subdomains (fdomain.earth.orderbox-dns.com, fdomain.mars.orderbox-dns.com, fdomain.mer...). VirusTotal reports 16 of 91 scanners flagging the host, and Google Safe Browsing labels it as social engineering. AlienVault OTX lists the domain in two threat‑intel pulses, and it is currently blocked by PhishDestroy and appears on one additional blocklist. The evidence confirms a Google impersonation scheme, but the exact payload, page content, and victim interaction flow have not been publicly disclosed. Defenders should immediately block rp-google.com at the DNS and proxy layers, add the domain to URL‑filtering policies, and monitor outbound connections to 209.99.184.226. Continuous threat‑intel feed updates should be consulted for any new indicators, and any observed credential submissions to this domain must be treated as compromised and require forced credential resets for affected accounts.