op[.]portal-drops[.]icu

On July 22, 2026 the domain op.portal-drops.icu was observed as an offline Google brand impersonation site. The domain was registered through Dynadot LLC on 20 October 2025 and resolves to the IP address 172.217.18.4, which belongs to AS15169 (Google LLC) located in the United States. The authoritative nameservers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No TLS certificate was presented when the site was queried, confirming the absence of HTTPS protection.

The HTTP response returned a page title of “Google”, matching the declared brand target and confirming the intent to masquerade as Google. VirusTotal analysis recorded five detections out of ninety‑five scanned security vendors, and the domain appears on a single public blocklist. PhishDestroy has actively blocked the domain, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting the high confidence of malicious intent. The classification aligns with the “Brand Impersonation” scam type reported in the intelligence feed.

Because the domain is currently offline, active content cannot be inspected, and the exact payload or credential‑harvesting mechanisms remain unknown. Nevertheless, the combination of a Google‑owned IP range, Cloudflare DNS, a generic Google page title, and multiple vendor detections provides strong evidence of a targeted impersonation campaign. Defenders should continue to monitor the domain for any re‑activation, enforce blocklisting of the IP 172.217.18.4 for traffic that does not originate from legitimate Google services, and incorporate the domain and its nameservers into threat‑intelligence feeds. Additional scrutiny of similar domains created after October 2025 that resolve to Google‑owned address spaces is recommended to pre‑empt future impersonation attempts.