somaliscan[.]live

The domain somaliscan.live is a confirmed phishing site engaged in brand impersonation targeting Google. It presents a fraudulent login page designed to harvest user credentials under the guise of the legitimate Google brand. No crypto drainer kit was observed. As of the latest verification, somaliscan.live has been taken offline.

Technical indicators confirm the elevated risk posed by somaliscan.live. The domain was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft and SOCRadar, and appears on 3 security blocklists: PhishDestroy, MetaMask, and SEAL. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on January 02, 2026, and resolved to the IP address 142.251.208.4, hosted on Google LLC's infrastructure in the US. No SSL certificate was issued, and the observed page title was 'Google'. Nameservers for the domain are ajay.ns.cloudflare.com and phoenix.ns.cloudflare.com. Gridinsoft assigned a trust score of 0 out of 100 to somaliscan.live.

Users who interacted with somaliscan.live should immediately change any passwords entered on the site, particularly for Google accounts. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for signs of fraud, such as unexpected login attempts or unauthorized transactions. Report the phishing domain to Google’s abuse team via their reporting form and to the Anti-Phishing Working Group at reportphishing@apwg.org. Additionally, notify local cybersecurity authorities or consumer protection agencies to aid in broader mitigation efforts.