mengfeilii[.]com

The domain mengfeilii.com has been identified as a high-risk entity impersonating the Google brand. It was registered on June 8, 2026, through NameSilo, LLC, and currently resolves to the IP address 34.120.55.66. The domain is still active and has been flagged by five out of 95 security vendors on VirusTotal, indicating a level of concern within the cybersecurity community. Additionally, it appears on two security blocklists, further corroborating its malicious intent. Security analysis shows a low trust score of 6 out of 100 according to Gridinsoft, which reinforces the assessment of a potential threat associated with this domain.

The use of a Let's Encrypt SSL certificate suggests that the domain operators are attempting to create a facade of legitimacy. However, the presence of an SSL certificate does not mitigate the risks associated with brand impersonation, especially given the evidence that the domain is actively being blocked by security services such as PhishDestroy and BLP-Malware. The domain's creation date is recent, which may indicate that it was set up specifically for fraudulent activities, likely targeting users of Google services.

Defenders should treat this domain with caution. Users should be educated to recognize signs of phishing attempts, such as unusual URLs or email communications that claim to be from Google but originate from this domain. Organizations should implement technical controls to block access to this domain and monitor for any associated phishing campaigns. Ongoing vigilance is recommended, as the domain is currently active and may adapt its tactics to evade detection.