90der-chck213767123.cfd

Random throwaway label '90der-chck213767123' on the .cfd TLD behind Cloudflare NS serves no content of its own and bounces every visitor to www.google.com — the classic cloaking/decoy behaviour of SMS-lure campaign domains that only show the real lure to targeted device/geo/token traffic; the Google branding shown belongs to the redirect destination, not this host, so there is no directly observed impersonation yet.

The domain 90der-chck213767123.cfd is a typosquat with no legitimate purpose: it redirects to Google's real homepage, masking its obfuscated name (containing numbers and hyphens typical of malware campaigns) behind a legitimate destination. This redirect-and-hide pattern is characteristic of a compromised or malicious redirect infrastructure, likely used to distribute traffic, evade detection, or set up for downstream abuse rather than direct phishing of this domain itself.