kladween[.]icu

The domain kladween.icu has been identified as a brand impersonation threat specifically targeting Google users. Currently classified as elevated risk and taken offline, this domain was designed to deceive visitors into believing they were accessing legitimate Google services. The site's page title was set to https://www.google.com/, a clear attempt to mimic the official Google homepage and trick users into entering sensitive information such as login credentials.

Technical analysis reveals that kladween.icu resolved to IP address 104.21.82.170 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain was created on May 20, 2026, and its SSL certificate was issued by Google Trust Services / WE1, further enhancing its deceptive appearance. Despite these efforts, security vendors flagged the domain, with 3 out of 95 VirusTotal engines detecting malicious activity. Additionally, it appeared on one security blocklist, indicating that threat intelligence systems had identified it as a risk.

Although the domain is now offline, users should remain vigilant. PhishDestroy recommends that anyone who may have visited kladween.icu or entered credentials should immediately change their Google passwords and enable two-factor authentication. It is also advisable to monitor accounts for suspicious activity. The quick action by security researchers and hosting providers led to the domain's takedown, but similar threats may emerge using different domains. Users should always verify URLs carefully and rely on official bookmarks rather than clicking links from unsolicited messages.