derfililiama[.]com

Analysis of derfililiama.com indicates that the domain was registered on February 21, 2026 through Dynadot LLC and is presently taken offline. The authoritative name servers are ns1.dyna-ns.net and ns2.dyna-ns.net, both of which resolve the domain to the IP address 142.250.186.100. Geolocation of this IP places it in Germany and associates it with ASN 15169, owned by Google LLC, suggesting the infrastructure is leveraging legitimate Google network resources to enhance credibility. The site presented a TLS certificate issued by Let’s Encrypt (R12) and employed Google Web Server software, HTTP/3, and HTTP Strict Transport Security (HSTS), all of which are typical of authentic Google services.

The page title returned by the server is "Google," matching the declared brand target. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, confirming that it is recognized as a malicious resource. VirusTotal scans show that four of ninety‑three security vendors flagged the domain, providing additional independent confirmation of suspicious activity. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of low legitimacy.

The scam type is identified as brand impersonation, specifically targeting Google users. While the domain is no longer reachable, defenders should continue to monitor for any re‑activation or related infrastructure, add the domain to internal blocklists, and ensure that endpoint protection solutions reference the observed indicators (IP address, name servers, TLS fingerprint, and vendor detections). Further investigation is required to determine whether additional domains share the same hosting configuration or certificate, which could indicate a broader campaign. Until the domain is confirmed permanently inactive, security teams are advised to treat any future resolution of derfililiama.com as malicious and to block related traffic at the network perimeter.