riceaifloki[.]xyz

This domain, riceaifloki.xyz, is identified as a brand impersonation phishing site targeting Google. Analysis confirms the page title as 'Google,' and the infrastructure mimics legitimate Google services to deceive users into disclosing credentials or sensitive information. No specific drainer kit signatures were detected, but the use of Node.js and Express suggests a custom or lightweight phishing framework designed for rapid deployment and evasion of traditional detection mechanisms.

Technical indicators reveal multiple red flags: the domain was registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.47.56, a Cloudflare-hosted endpoint that leverages HTTP/3 and HSTS to project a veneer of legitimacy. VirusTotal detection metrics show 15 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing (GSB) does not list the domain, indicating either recent takedown or evasion of GSB’s detection pipeline.

As of the latest assessment, riceaifloki.xyz has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, residual risk persists due to the domain’s recent creation date and the use of Cloudflare, which may facilitate rapid redeployment under a new subdomain or IP. Organizations are advised to monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED or resolving to the same IP range. Network-level blocking of 104.21.47.56 is recommended as a precautionary measure. Users should verify domain authenticity through official channels and report any suspicious activity to their security teams for further investigation.