boon-reward[.]lol

This domain, boon-reward.lol, presents a credential harvesting threat specifically targeting Google account holders through brand impersonation techniques. Analysis of the page structure reveals a cloned interface mimicking legitimate Google authentication portals, complete with identical page titles and visual elements designed to deceive users into submitting login credentials. The infrastructure employs Google Web Server technology and enforces HSTS policies, suggesting an attempt to appear technically legitimate while harvesting sensitive information. Infrastructure analysis provides concrete indicators of malicious intent. The domain resolves to IP address 172.67.136.253 and was registered through Dynadot LLC on April 28, 2026, with a Let's Encrypt SSL certificate. Despite appearing on three security blocklists, the domain shows 0/95 detections in VirusTotal analysis, indicating either recent deployment or effective evasion techniques. The discrepancy between blocklist presence (3) and detection engines (0) suggests targeted distribution or limited exposure at the time of analysis. Users who may have interacted with this domain should immediately revoke any submitted credentials through official account recovery procedures. System administrators should monitor network traffic for connections to 172.67.136.253 and implement blocklist updates containing this domain. The April 2026 registration date, combined with current offline status, suggests this may represent either a preemptive registration or a temporarily suspended campaign, warranting continued monitoring for reactivation attempts.