stivuitoare-bucuresti[.]ro

PhishDestroy has identified stivuitoare-bucuresti.ro as an elevated-risk domain engaged in brand impersonation of Google. Even though the site's page title references forklift rentals in Bucharest, the underlying threat involves mimicking Google's login or verification pages to harvest user credentials. This domain was registered through CYBER_FOLKS S.R.L. and created on December 7, 2019, but only recently began exhibiting malicious behavior.

Technical indicators are severe: VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious. It appears on two security blocklists and resolves to IP 217.156.47.28. AlienVault OTX shows the domain present in 16 threat intelligence pulses, indicating widespread sharing of indicators. The SSL certificate is issued by Let's Encrypt (R13), which is common for both legitimate and fraudulent sites.

Users encountering this domain should never enter any credentials or personal information. Since the threat is brand impersonation of Google, verify any page asking for Google account details by checking the URL carefully. Report the domain to Google Safe Browsing and your email provider. If you have already submitted data, change your Google password immediately and enable two-factor authentication. The domain is currently offline, but similar variants may appear—stay vigilant for misspelled or lookalike domains targeting Google.