sxom[.]clgdsfghgfhjjiihgfcdss[.]xyz

The domain sxom.clgdsfghgfhjjiihgfcdss.xyz is flagged as a brand impersonation threat targeting Gmail. Analysis indicates that this domain is part of a campaign designed to deceive users into believing they are interacting with Google services, potentially leading to credential theft or other malicious activities.

Technical indicators for sxom.clgdsfghgfhjjiihgfcdss.xyz include a VirusTotal score of 14/95, indicating a moderate level of detection by security vendors. The domain was registered through NameCheap, Inc., and resolves to the IP address 172.253.63.99, which is located in the United States and associated with AS15169 Google LLC. The domain was created on October 29, 2025, and currently appears on 2 security blocklists, including PhishDestroy and PhishingDB. The domain does not have an SSL certificate, which may further suggest its illegitimate nature.

The domain sxom.clgdsfghgfhjjiihgfcdss.xyz is currently offline, reducing the immediate risk to users. However, the infrastructure and techniques used in this campaign warrant continued monitoring. Response actions should include blocking the domain at network and endpoint levels to prevent any accidental access. Users should be educated to verify the legitimacy of any Gmail-related services and to avoid clicking on suspicious links or entering credentials on unfamiliar websites. The remaining risk is considered elevated due to the potential for the domain to be reactivated or for similar domains to be registered in the future.