get-tea[.]com

This domain, get-tea.com, is flagged as a brand impersonation threat targeting Google users. The site presents a fraudulent login portal designed to harvest credentials or deploy malicious payloads, such as crypto drainers or spyware. Users who visit the page are exposed to unauthorized data collection, account compromise, or financial theft, particularly if they enter sensitive information like passwords or recovery codes. The site’s infrastructure and visual design closely resemble legitimate Google services, increasing the risk of successful deception. Analysis indicates the domain was registered on June 01, 2026, through OwnRegistrar, Inc., a registrar often associated with high-risk domains. It resolves to the IP address 172.67.167.11 and has been detected by 6 out of 95 security vendors on VirusTotal, including MetaMask and PhishDestroy. The site’s page title is explicitly set to 'Google,' and it appears on three security blocklists. Detected technologies include Google Web Server, HSTS, and HTTP/3, which may be used to lend an appearance of legitimacy while obscuring malicious intent. If you visited get-tea.com or entered credentials on the site, immediate action is required. Disconnect the affected device from the network to prevent further data exfiltration. Reset passwords for any accounts accessed during the session, prioritizing email, financial, and cryptocurrency platforms. Enable multi-factor authentication (MFA) where available, using app-based or hardware tokens rather than SMS. Scan the device with updated security tools to detect and remove any installed malware. Monitor linked accounts for unauthorized activity and report the incident to relevant platforms, such as Google’s security team or your organization’s IT department. Avoid reusing passwords across services to mitigate the risk of credential-stuffing attacks.