balihaiperu[.]com

This domain, balihaiperu.com, is actively flagged as a high-risk brand impersonation site targeting Google. Infrastructure analysis reveals the domain was registered on November 14, 2002, through GoDaddy.com, LLC, and currently resolves to the IP address 194.163.157.158. The site presents a page titled 'Sign in - Google Accounts,' directly indicating an attempt to mimic Google's login interface. The domain is detected on two security blocklists, including PhishDestroy and BLP-Malware, and appears in 15 threat intelligence pulses on AlienVault OTX, signaling widespread recognition as malicious. While the domain uses a Let's Encrypt SSL certificate, which is common among both legitimate and fraudulent sites, its Gridinsoft trust score is 2 out of 100, further confirming its low reputation. Technologies detected on the domain include WordPress, MySQL, PHP, jQuery Mobile, jQuery Migrate, jQuery, Google Analytics, and HTTP/3, suggesting a structured web environment often exploited for phishing operations. One security vendor on VirusTotal has flagged this domain, though the absence of broader detections does not diminish the existing evidence of malicious intent. Defenders should treat this domain as an active threat, block access at the network level, and monitor for any attempts to harvest credentials or distribute malware. The domain remains active as of July 12, 2026, and no signs of takedown or remediation have been observed. Further analysis of the site's backend or traffic patterns may reveal additional indicators of compromise or associated threat actor infrastructure.