lhkde[.]com

This domain is flagged for elevated-risk brand impersonation targeting Google, a technique frequently exploited to deceive users into disclosing credentials or interacting with fraudulent services. Analysis indicates the infrastructure was designed to mimic legitimate Google properties, as evidenced by the page title 'Google' and the use of Google Web Server technology. The domain poses a significant threat due to its convincing impersonation tactics, which are commonly leveraged in credential harvesting, malware distribution, or secondary phishing campaigns. Infrastructure analysis reveals the domain lhkde.com was registered through OwnRegistrar, Inc., on April 27, 2026, and currently resolves to the IP address 91.202.233.170. Security vendor assessments on VirusTotal indicate 6 out of 95 engines flag the domain as malicious, while it appears on three distinct security blocklists. Additional technical indicators include a Gridinsoft trust score of 0/100, detection by MetaMask, PhishDestroy, and SEAL, and the presence of HSTS and HTTP/3 protocols. The domain has since been taken offline, though historical resolution data and registration details remain relevant for threat correlation. Mitigation steps for this type of brand impersonation threat include immediate blocking of the domain and its associated IP (91.202.233.170) at the network perimeter. Organizations should deploy email and web filtering rules to prevent user interaction with the domain or any subdomains. End-users should be educated on recognizing impersonation tactics, such as verifying domain legitimacy before entering credentials. Security teams are advised to monitor for related infrastructure, including domains registered through OwnRegistrar, Inc., or resolving to the same IP range, as these may indicate broader campaign activity. Historical WHOIS data and passive DNS records should be preserved for forensic analysis.