continentalluck[.]live

Analysis of continentalluck.live shows a newly registered domain created on February 27, 2026 that was used for a brand impersonation campaign targeting Google. The site presented the page title "Google Chrome - The Fast & Secure Web Browser Built to be Yours," indicating an attempt to lure victims with a familiar Google product reference. Infrastructure inspection reveals that the domain resolved to IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. DNS records list anton.ns.cloudflare.com and pearl.ns.cloudflare.com as authoritative nameservers, and the registration was performed through NiceNIC International Group Co., Limited.

The site employed a Let's Encrypt certificate (E7) for TLS, providing a valid HTTPS handshake despite the malicious intent. Malware scanning on VirusTotal recorded two positive detections out of ninety-three security vendors, confirming that at least some scanners identified the domain as malicious. The campaign was classified as a brand impersonation using the Gambler Scam phishing kit, and it was subsequently blocked by the PhishDestroy service and listed on a single security blocklist. Current status indicates the domain has been taken offline, but its recent creation and the presence of active detection signatures suggest that similar domains may be generated in the near term.

Defenders should continue to monitor Cloudflare‑hosted IP ranges for rapid domain turnover, enforce URL filtering for the exact domain and its associated IP, and ensure that endpoint protection solutions are updated with the latest threat intelligence feeds that include this indicator. Additionally, organizations should educate users about unexpected Google‑related prompts and verify TLS certificates, as legitimate Google services use distinct certificate authorities. Ongoing vigilance is recommended to capture any re‑use of the underlying infrastructure in future impersonation attempts.