klima[.]airdropsalert[.]bar

This domain, klima.airdropsalert.bar, is identified as a high-risk brand impersonation threat specifically targeting Gmail users. Analysis indicates the infrastructure was designed to mimic Google’s login interface, as evidenced by the page title 'Google' and the absence of an SSL certificate, a common tactic in credential theft campaigns. No crypto drainer kit signatures were observed, distinguishing this from wallet-targeting phishing operations. Infrastructure analysis reveals the domain was registered on October 20, 2025, through Dynadot LLC and resolves to the IP address 216.58.206.68, geolocated in Germany under AS15169 (Google LLC). Security telemetry shows 18 out of 95 vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one additional security blocklist, and no SSL certificate was deployed, further reducing user trust indicators. The domain has since been taken offline, likely due to detection by automated security systems or registrar enforcement. However, residual risk remains for users who may have interacted with the page prior to its deactivation. Organizations are advised to monitor for credential reuse attempts and review logs for connections to the IP 216.58.206.68 during the active window. Users should treat any prior interaction with this domain as a potential compromise of Gmail credentials and initiate password resets immediately.