tge-almanaks[.]co

Analysis of the domain tge-almanaks.co indicates it was a brand-impersonation phishing site targeting Google, operational until recently taken offline. The domain resolved to IP address 142.250.72.110, which is part of AS15169 (Google LLC) in the United States, though this IP association does not confirm hosting by Google itself. The page title 'almanac' aligns with a potential impersonation of Google services, though the exact content or functionality of the site remains unconfirmed. Registration occurred on October 30, 2025, through OwnRegistrar, Inc., with Cloudflare nameservers (fay.ns.cloudflare.com and lamar.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1).

Detection data shows the domain appeared on two security blocklists and was flagged by one of 95 security vendors in VirusTotal. AlienVault OTX included the domain in a single threat intelligence pulse, while PhishDestroy and ScamSniffer both blocked access. Technologies detected include Cloudflare and HTTP/3, suggesting infrastructure commonly used to obscure malicious activity.

The domain is currently offline, but defenders should treat any future resolution or re-registration as high-risk. Organizations should update blocklists to include tge-almanaks.co and monitor for related domains using similar naming patterns or infrastructure. No evidence confirms whether credentials or sensitive data were collected, so affected users should remain vigilant for follow-up phishing attempts.