klima[.]beefyapp[.]cfd

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users into disclosing Gmail credentials. Analysis indicates the site replicates Google's login interface, leveraging social engineering to harvest sensitive account information. The threat type is credential theft through brand spoofing, with no indications of additional payload delivery such as malware or crypto drainers. Infrastructure analysis reveals the domain klima.beefyapp.cfd was registered on October 02, 2025, through Dynadot LLC. It resolves to the IP address 142.250.186.132, which is geographically located in the United States under AS15169 (Google LLC). Despite the IP association with a legitimate provider, the domain lacks an SSL certificate, increasing exposure to man-in-the-middle interception. VirusTotal reports 11 out of 95 security vendors detecting this domain as malicious, while it appears on one security blocklist. The page title 'Google' further confirms the intent to impersonate Gmail's official branding. Mitigation requires immediate blocking of the domain and its resolving IP at network perimeter defenses. Users who accessed the site should reset Gmail credentials via an unaffected device and enable multi-factor authentication. Organizations should audit logs for connections to 142.250.186.132 or the domain name, particularly from endpoints exhibiting anomalous authentication attempts. Security teams are advised to monitor for follow-up attacks, such as session hijacking or lateral movement, using the compromised credentials. Domain registration details, including the October 2025 creation date and Dynadot registrar, should be incorporated into threat intelligence feeds for cross-referencing future incidents.