xpin-network-orbit[.]live

This domain, xpin-network-orbit.live, is flagged as a brand impersonation phishing site targeting Google. Analysis indicates the site mimics legitimate Google services, likely to harvest credentials or distribute malicious payloads. The page title "Document" suggests an attempt to deceive users into interacting with fraudulent content under the guise of a legitimate file or service. No specific drainer kit was identified, but the infrastructure aligns with common phishing frameworks designed to exploit trust in the targeted brand. Technical indicators confirm the domain's malicious nature. The domain was registered on June 11, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to the IP address 104.21.25.245. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious. The domain appears on four security blocklists, and its SSL certificate, issued by Google Trust Services, is likely spoofed to lend credibility. Technologies detected include Node.js, Express, HSTS, Cloudflare, and HTTP/3, which are often leveraged to obfuscate malicious activity and evade detection. As of the latest assessment, xpin-network-orbit.live has been taken offline, reducing immediate risk to users. However, the domain's infrastructure and registration details remain a concern, as threat actors may repurpose or re-deploy similar assets. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Monitoring for related domains registered through the same registrar or resolving to the same IP range is recommended to mitigate potential follow-up campaigns. Users should verify the authenticity of any communication or service claiming affiliation with Google, particularly those directing to unfamiliar domains.