marketpulsebrokerag[.]com

On 22 July 2026, analysis identified marketpulsebrokerag.com as an active component of a Google brand‑impersonation campaign classified as a Tech Support Scam. The domain was registered on 21 February 2026 and subsequently resolved to the IPv4 address 198.12.80.250, which belongs to the HostPapa hosting provider (AS36352) located in the United States. The site presented the page title “marketpulsebrokerag.com - Premium Crypto Currency Investment Company,” a mismatch that suggests a deceptive investment lure rather than genuine Google support content. The SSL certificate is recorded with an R10 rating, indicating a low trust score.

VirusTotal scans show that two of ninety‑three security vendors flagged the domain, reinforcing the suspicion of malicious intent. The domain appears on one external security blocklist and has been blocked by the PhishDestroy mitigation service, leading to its current offline status. Evidence confirms that the infrastructure is explicitly targeting Google users, although the exact phishing kit or payload has not been disclosed.

Uncertainty remains regarding the full scope of victim outreach, the presence of additional supporting domains, and whether the site hosted any executable payloads before takedown. Defenders should continue to monitor the IP 198.12.80.250 for any re‑use, enforce URL filtering against the domain and its resolved IP, and update endpoint and email security policies to block traffic to this host. Incident response teams should also verify that no credential or malware artifacts were exfiltrated from any previously compromised accounts that interacted with the site.