klima[.]beefyapps[.]lat

This report details a phishing threat targeting Google users. The domain klima.beefyapps.lat presented a page with the title "Google" and is classified as a Google Phishing scam, impersonating the Google brand to deceive users into submitting sensitive credentials. The threat posed is credential theft, where victims are tricked into entering login details on a fraudulent interface.

Technical analysis confirms the malicious nature of the site. VirusTotal detection shows 5 out of 95 security vendors flagged the domain as malicious. It is listed on 1 blocklist and flagged by ChainPatrol, alphaMountain.ai, CyRadar, Forcepoint ThreatSeeker, and Fortinet. The domain was registered on 2025-10-24 through Dynadot LLC, hosted on IP address 216.58.206.36, located in Germany, and belonging to AS15169 Google LLC. The site uses nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, and has no SSL certificate.

The domain is currently down or offline, rendering the phishing page inaccessible. The risk level is high for any user who previously visited the site or submitted information, as credentials may have been compromised. The combination of brand impersonation, low security vendor detection, and recent creation date indicates a targeted, short-lived phishing campaign.