fanciersprout-o7rxov[.]stormkit[.]dev

Analysis of fanciersprout-o7rxov.stormkit.dev indicates a high‑risk brand‑impersonation campaign targeting Google users. The domain resolves to the IPv4 address 91.98.218.209, hosted in Germany under ASN 24940 (Hetzner Online GmbH). DNS is served by four AWS name servers (ns-1110.awsdns-10.org, ns-1610.awsdns-09.co.uk, ns-422.awsdns-52.com, and a fourth entry truncated in the source). Registration details show the domain was provisioned through GoDaddy.com, LLC. TLS termination uses a Let’s Encrypt certificate (serial E7), confirming encrypted communications but offering no authenticity beyond the free CA.

HTTP probing returned a 404 status, and the page title is absent, suggesting the site was taken offline or never served content before takedown. Reputation data reinforces malicious intent: Google Safe Browsing flags the domain for social‑engineering, and it appears on at least one security blocklist. Gridinsoft assigns a trust score of 0 / 100, indicating severe distrust. VirusTotal reports that 15 of 91 scanned security vendors flagged the domain, consistent with the observed blocklist entries.

PhishDestroy has explicitly blocked the domain, and the overall classification is brand impersonation of Google. Uncertainty remains regarding the exact payload or user‑interaction vector, as the site did not deliver a page to analyze before being seized. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host or similar sub‑domains on the Hetzner network, and update URL filtering lists with the current indicators. Threat‑intel feeds should be enriched with the observed SSL fingerprint, ASN, and registration metadata to improve detection of future impersonation attempts leveraging the same infrastructure.