selgehotelside[.]com

This domain is flagged as an elevated-risk brand impersonation site specifically targeting Google. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with legitimate Google services, likely through a fake login or credential harvesting portal. The page title 'Anasayfa - Selge Beach' suggests an attempt to disguise the malicious intent under a seemingly unrelated hospitality theme, a common tactic to evade automated detection systems. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to IP address 172.67.174.77, which is proxied through Cloudflare, a technique often used to obscure the true origin of malicious traffic. VirusTotal reports 2 out of 95 security vendors have flagged this domain, and it appears on one security blocklist. Detected technologies include PHP, Tailwind CSS, Unpkg, and Cloudflare Browser Insights, further indicating a sophisticated setup designed to mimic legitimate web properties. Mitigation steps for this threat type include immediate blocking of the domain and its resolving IP address across all network security controls. Organizations should monitor for any attempts to access this domain from internal networks and investigate potential credential exposure if user interaction is detected. Security teams are advised to review logs for connections to 172.67.174.77 and correlate with any suspicious authentication attempts on Google services. End-users should be educated on recognizing brand impersonation tactics, particularly those involving unexpected login prompts or redirects to unfamiliar domains. Given the domain's current offline status, continuous monitoring for reactivation or related infrastructure is recommended.