lahatopia[.]cultuurvanverbinding[.]online

The domain lahatopia.cultuurvanverbinding.online was registered through Key-Systems GmbH on 27 January 2025. DNS resolution points to the address 62.60.226.175, which belongs to AS214351 (FEMO IT SOLUTIONS LIMITED) and is geolocated in Germany. Both authoritative nameservers, rudy.ns.cloudflare.com and sima.ns.cloudflare.com, are operated by Cloudflare, indicating the use of a third‑party DNS service. No TLS certificate was observed for the host, confirming that the site was served only over HTTP.

The page title returned by the server was “LähiTapiola”, while the listed target brand is Google, classifying the activity as a brand‑impersonation attempt aimed at banking credentials. VirusTotal scans show that five out of ninety‑five security vendors flagged the domain as malicious, and the domain appears on a single external blocklist. Gridinsoft assigned a trust score of 0 out of 100, and PhishDestroy has already taken the site offline. The infrastructure attributes—recent registration, low‑reputation IP, lack of SSL, and multiple detection signals—suggest a short‑lived phishing campaign.

At present the site is not reachable, so visual content and exact phishing kit cannot be verified. Analysts should continue to monitor the IP address for re‑use, enforce blocking of the domain at perimeter defenses, and add the host to internal threat‑intel feeds. Additional scrutiny of any future DNS changes for the domain or its nameservers is recommended, as the use of Cloudflare may facilitate rapid re‑deployment. Defenders are advised to update URL filtering rules to include the domain and to watch for similar Google‑impersonation patterns that reference unrelated page titles.