xn--leder-y1a[.]app

The domain xn--leder-y1a.app is identified as a high-risk brand impersonation threat, specifically targeting the Google brand. This domain poses a significant risk to users as it attempts to deceive them into believing they are interacting with a legitimate Google service, potentially leading to the compromise of personal and sensitive information.

Analysis indicates that the domain xn--leder-y1a.app is flagged by 11 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 10, 2026. Infrastructure analysis reveals that the domain resolves to the IP address 142.251.154.119. The SSL certificate is issued by Let's Encrypt, which is a common tactic used by threat actors to increase the perceived legitimacy of their phishing sites. The domain appears on three security blocklists, further confirming its malicious intent. The page title 'Google' is consistent with the brand impersonation technique, aiming to replicate the appearance of a genuine Google service.

Users who have visited this domain are advised to immediately change any passwords or credentials that may have been entered on the site. It is also recommended to monitor financial and account statements for any unauthorized activity. If any suspicious activity is detected, users should report it to their respective service providers and consider running a full system scan to ensure no malware has been installed. Additionally, users should be cautious of similar domains and verify the URL of any Google service they intend to access.