cn[.]lnmxys[.]com

The domain cn.lnmxys.com has been identified as a brand impersonation threat specifically targeting Google. Analysis indicates the domain is currently offline, though it previously hosted content masquerading as legitimate Google services. The page title, "ManBetX(万博体育)官网|英超狼队和水晶宫全球赞助伙伴," does not align with Google’s branding, further confirming its fraudulent intent to deceive users into believing they are accessing an official Google platform. Technical indicators reveal the domain was created on November 24, 2019, and registered through GoDaddy.com, LLC. It resolves to the IP address 45.200.67.196, located in Hong Kong under AS133847 (Anpple Tech Enterprise). The SSL certificate is issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36). Security vendors have flagged this domain, with 17 out of 95 VirusTotal engines detecting it as malicious. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB, reinforcing its classification as a high-risk infrastructure. Current status confirms the domain is offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant, as similar domains may emerge. Recommended actions include blocking the domain and associated IP (45.200.67.196) at the network level, updating endpoint protection rules to detect brand impersonation attempts, and monitoring for newly registered domains mimicking Google or other high-value targets. Security teams should also review logs for any prior interactions with this domain to assess potential compromise.