964531-cb[.]com

This domain, 964531-cb.com, is flagged as a brand impersonation threat targeting Google, designed to harvest user credentials through deceptive login interfaces. Analysis indicates the site replicates Google’s visual identity, including the page title 'Google,' to trick users into submitting sensitive account information. No explicit drainer kit signatures were detected in the initial scan, but the infrastructure aligns with credential phishing campaigns observed in prior incidents involving the same registrar. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 18, 2026, and resolves to the IP address 142.251.150.119. Security vendor assessments on VirusTotal report 4 out of 95 engines flagging the domain as malicious, while it appears on three independent security blocklists. The domain was not listed in Google Safe Browsing at the time of detection. Detected technologies include Google Web Server, HTTP Strict Transport Security (HSTS), and HTTP/3, suggesting an attempt to mimic legitimate Google infrastructure while maintaining encrypted connections. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. While the immediate threat is mitigated, residual risk remains due to the domain’s recent registration and prior malicious activity. Users who accessed the site before its deactivation should assume potential credential exposure and initiate password resets for associated Google accounts. Organizations are advised to monitor for related domains registered under the same registrar or resolving to the same IP range, as threat actors often reuse infrastructure across campaigns.