klarna-app[.]biz

This domain, klarna-app.biz, is identified as a high-risk phishing site specifically designed to impersonate Klarna, a widely used payment service provider. Analysis indicates the domain is currently active and engineered to deceive users into submitting sensitive financial or personal credentials under the pretense of legitimate Klarna account verification or payment processing. Infrastructure analysis reveals the domain resolves to IP address 172.67.177.35 and is secured with an SSL certificate issued by Google Trust Services, a common tactic used by threat actors to create a false sense of legitimacy. As of the latest assessment, the domain has been flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The domain's hosting and certificate infrastructure suggest an attempt to mimic legitimate Klarna services, increasing the likelihood of successful credential harvesting. The domain remains active and poses a significant risk to users unfamiliar with legitimate Klarna domains. Organizations and individuals are advised to block access to klarna-app.biz at the network level and update endpoint protection rules to include this domain. Users who may have interacted with the site should immediately reset their Klarna account credentials and monitor for unauthorized transactions. Security teams are encouraged to correlate this indicator with other known phishing infrastructure to identify potential campaign linkages.