knowledgedrop[.]saharai[.]xyz

The domain knowledgedrop.saharai.xyz is currently active and presents a page title of “Google”, directly indicating an attempt to impersonate the Google brand. The site was registered on February 21 2026 and is classified as a brand‑impersonation scam. Its sole observable content is the title; no further page analysis is available. Infrastructure analysis shows the domain resolves to IP address 142.250.185.100, which belongs to AS15169 owned by Google LLC and is located in the United States. The SSL certificate presented is identified as “WE2”, and the HTTP response returns status code 200, indicating a functional web server. Registration details list PDR Ltd. d/b/a PublicDomainRegistry.com as the registrar, and the authoritative nameservers are ns2.verification-hold.suspended-domain.com and ns1.verification-hold.suspended‑, suggesting the domain is hosted on a verification‑hold service. Reputation signals are strongly negative. The domain appears on two security blocklists and is currently blocked by PhishDestroy and ScamSniffer. VirusTotal scans have flagged the domain by five of ninety‑five antivirus engines, and Gridinsoft assigns a trust score of 0 out of 100. These indicators, combined with the active status, confirm a high‑risk profile. Defenders should immediately block DNS resolution for knowledgedrop.saharai.xyz and add it to URL filtering rules. Network monitoring should watch for outbound connections to 142.250.185.100 that are not initiated by legitimate Google services, and any associated HTTP 200 responses should be logged for further investigation. Continuous re‑scanning of the domain on VirusTotal and other sandboxes is advised to capture any evolving payloads.