drrdeesrfesr[.]top

The domain drrdeesrfesr.top was registered on 2026-04-14 through Dynadot LLC and is currently active. It is classified as a high‑risk Google brand‑impersonation campaign. The site returns HTTP 302 redirects and serves a page titled “Приложения в Google Play – Боги Олимпа (Gods of Olympus)”, indicating an attempt to masquerade as official Google Play content. Infrastructure analysis shows the domain resolves to IP 172.67.137.28, which belongs to Cloudflare, Inc. and is geolocated in Canada. Authoritative nameservers are jeremy.ns.cloudflare.com. and nucum.ns.cloudflare.com., confirming the use of Cloudflare’s DNS and proxy services. The SSL certificate is issued by Let’s Encrypt (E7), and the site employs reCAPTCHA, HSTS, Google Tag Manager, Google Analytics, and HTTP/3, all of which are typical of legitimate Google‑related services but do not mitigate the impersonation risk. Threat intelligence indicates the domain has been flagged by PhishDestroy and appears on a single security blocklist. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports a single vendor detection out of 95, suggesting limited visibility rather than a clean verdict. The page title in Russian referencing “Gods of Olympus” is unrelated to Google, implying a lure to Google Play users, possibly to harvest credentials or distribute unwanted software. Defenders should add drrdeesrfesr.top to outbound and inbound deny lists, enforce DNS sink‑hole or block‑page policies for the domain, and monitor any resolved connections to 172.67.137.28. Continuous inspection of traffic to Cloudflare edge nodes for this host is advised, as the proxy can mask further command‑and‑control infrastructure. Organizations should also educate users about the anomalous Russian‑language page that pretends to be a Google Play listing, reinforcing verification of URLs before entering credentials.