google8989[.]top

Analysis of the domain google8989.top indicates it was actively used for a tech support scam impersonating Google, as classified in available threat intelligence. The domain was registered on March 3, 2026, through NameSilo, LLC, and resolved to the IP address 45.207.215.172, hosted by AS401696 (cognetcloud INC) in Hong Kong. The page title retrieved from the site was '购物 - 好叭工作室', which does not directly reference Google but aligns with broader fraudulent activity patterns observed in brand impersonation schemes. No SSL certificate was detected, increasing the likelihood of unencrypted data transmission.

The domain appeared on three security blocklists and was flagged by at least one of 94 security vendors on VirusTotal, though the specific detection context remains unverified. It was blocked by PhishDestroy, MetaMask, and SEAL, suggesting recognition as malicious infrastructure. The nameservers (ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com) are consistent with those used in other phishing operations, though this alone does not confirm intent. As of July 22, 2026, the domain is offline, limiting further analysis of its operational behavior.

Defenders should treat this domain as part of a historical tech support scam campaign targeting Google users. Network-level blocking of the IP 45.207.215.172 and associated nameservers may mitigate residual risk from related infrastructure. No evidence suggests this domain was part of a larger phishing kit or hosted additional malicious payloads, but monitoring for re-registration or similar naming conventions (e.g., 'google' followed by numeric sequences) is recommended.