karrier[.]app

Analysis of the domain karrier.app indicates a credential-phishing operation targeting Gmail users, first observed on February 21, 2026. The domain was registered through Web Commerce Communications Limited (WebNic.cc) and resolves to 142.250.80.36, an IP address assigned to Google LLC (AS15169) in the United States. Nameservers ns100.webnic.cc and ns101.webnic.cc are consistent with the registrar's infrastructure. The SSL certificate received a WR2 rating, suggesting weak or misconfigured encryption.

The page title 'Google' and the stated brand target 'gmail' align with credential-phishing tactics. At the time of assessment, the domain appeared on two security blocklists and was actively blocked by PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0/100. Three out of 93 security vendors on VirusTotal flagged the domain as malicious.

The domain is currently offline, though defenders should treat it as a confirmed threat due to its prior activity and detection history. No evidence of a phishing kit or additional scam classification (e.g., crypto, investment) is present in available data. The exact content of the phishing page remains unanalyzed, but the combination of brand impersonation, low trust scores, and blocklist presence confirms its malicious intent. Organizations should ensure endpoint and email security tools block karrier.app and monitor for related domains using similar naming patterns or registrar infrastructure.