sale-id6284729[.]info

The domain sale-id6284729.info was registered on February 27, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., placing the host in the United States. Both authoritative nameservers, deb.ns.cloudflare.com and johnny.ns.cloudflare.com, are Cloudflare‑provided, indicating the attacker leveraged Cloudflare’s CDN and DNS services to hide origin infrastructure. No TLS certificate is presented for the domain, meaning HTTPS connections would be unavailable or would fall back to plain HTTP, a common practice for temporary malicious sites.

The HTTP response that was captured before takedown displayed a page title of "Just a moment...", a generic placeholder that offers no insight into the content or any credential‑harvesting forms. The site was flagged by the PhishDestroy blocklist and appears on a single additional security blocklist, confirming that at least one external sinkhole has identified it as malicious. Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, effectively rating the domain as completely untrusted. VirusTotal scans reported that four of ninety‑three antivirus engines flagged the domain, providing modest but corroborating detection evidence.

The domain is explicitly marked as a brand‑impersonation campaign targeting Google, though the exact phishing technique or payload was not observed before the takedown. Because the site is offline, a full content‑level examination is not possible, leaving the precise user‑facing artifacts uncertain. Defenders should continue to block the domain at network perimeter, add the IP 188.114.97.3 to any threat‑intel watchlists, and monitor for future registrations that reuse the same registrar, nameservers, or Cloudflare ASN.