naorisprotocoi[.]xyz

The domain naorisprotocoi.xyz is a confirmed phishing site engaged in brand impersonation targeting Google. It presents itself as an official Google page to deceive users into entering credentials or other sensitive information, posing a risk of account compromise. No crypto drainer kit was detected. As of the latest verification, naorisprotocoi.xyz has been taken offline.

Technical indicators for naorisprotocoi.xyz show limited but clear signs of malicious activity. The domain was flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and Forcepoint ThreatSeeker. It appears on one security blocklist, PhishDestroy, and was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on July 31, 2025. The domain resolves to the IP address 192.178.155.106, hosted on Google LLC's infrastructure (AS15169), with no SSL certificate issued. The observed page title was 'Google', reinforcing its impersonation attempt.

Users who may have interacted with naorisprotocoi.xyz should immediately change their Google account passwords and enable two-factor authentication (2FA) if not already active. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions. Report the phishing domain to Google’s abuse reporting system and to platforms like PhishTank or the Anti-Phishing Working Group to aid in broader takedown efforts. If financial or sensitive data was exposed, consider contacting relevant institutions to secure accounts.