xerofex[.]com

The domain xerofex.com has been identified as a high-risk brand impersonation threat targeting Google, specifically mimicking the Google Chrome web browser. Analysis confirms the domain is currently offline, though prior activity involved presenting a fraudulent webpage titled 'Google Chrome - The Fast & Secure Web Browser Built to be Yours.' This threat type is classified as brand impersonation, designed to deceive users into believing they are interacting with legitimate Google services. Infrastructure analysis reveals the domain was registered through Dynadot LLC on February 21, 2026, an unusually forward-dated creation that may indicate an attempt to evade immediate detection. The domain resolved to the IP address 172.67.194.125, geolocated within the United States and associated with AS13335 (Cloudflare, Inc.), a common proxy service utilized to obscure malicious infrastructure. At the time of assessment, the domain appeared on three distinct security blocklists, while VirusTotal reported detections from 18 of 95 security vendors. The SSL certificate was issued under the identifier WE1, further suggesting automated or low-effort registration practices. Current status indicates the domain has been taken offline, though residual risk remains due to the potential for reactivation or migration to alternative infrastructure. Organizations and end-users are advised to implement proactive measures, including the deployment of domain-based blocking rules for xerofex.com and its associated IP address. Network-level monitoring should prioritize domains registered through Dynadot LLC exhibiting similar creation date anomalies or Cloudflare-hosted infrastructure. Users encountering pages impersonating Google Chrome should verify the legitimacy of the URL and SSL certificate before interacting with any embedded elements. Security teams are encouraged to review historical DNS resolution data for potential prior exposure.