114514[.]exchange

This domain, 114514.exchange, is flagged as a high-risk brand impersonation phishing site targeting Google. Analysis indicates the domain was designed to mimic the appearance of legitimate Google services, as evidenced by the page title 'Google' and the use of an SSL certificate issued by Google Trust Services. No direct evidence of a crypto drainer kit or credential-harvesting payload was observed, but the infrastructure aligns with known phishing campaigns aimed at deceiving users into divulging sensitive information or accessing fraudulent services. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.187.80, hosted on AS13335 (Cloudflare, Inc.) in the United States. It was registered on February 21, 2026, through NiceNIC International Group Co., Limited. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal detection metrics report 20 out of 95 security vendors flagging the domain as malicious. The SSL certificate, issued under the WE1 intermediate, does not mitigate the risk, as phishing sites frequently abuse legitimate certificate authorities to appear trustworthy. As of the latest assessment, 114514.exchange has been taken offline, reducing immediate exposure to end users. However, the domain's registration remains active, and the infrastructure could be repurposed for future malicious activity. Organizations and individuals are advised to monitor for residual DNS caching, block the domain at the network level, and verify SSL certificate transparency logs for any reissuance attempts. Users who may have interacted with the domain should assume potential credential exposure and initiate password resets for associated accounts.