From what I can tell, it's actually Google, but then they redirect you to a malicious URL after auth/approval