k-fin[.]cc

This domain, k-fin.cc, is actively flagged as a high-risk credential phishing site. Registered on May 20, 2026, through NameSilo, LLC, it remains operational as of July 12, 2026. The page title 'Log In' suggests a focus on harvesting user credentials, though the specific brand or service being impersonated is not confirmed in available data. Infrastructure analysis reveals the domain resolves to 172.67.136.27 and employs Cloudflare for hosting and security, including HSTS and HTTP/3 protocols. The SSL certificate is issued by Google Trust Services, a common but not inherently malicious provider. Security vendors have detected malicious activity, with 15 of 95 engines flagging the domain on VirusTotal. It appears on four security blocklists and has been referenced in 16 threat intelligence pulses on AlienVault OTX, indicating broader recognition of its malicious nature. Defensive tools such as SEAL, MetaMask, PhishDestroy, and BLP-Malware have already blocked access to this domain, and Gridinsoft assigns it a trust score of 0/100. Defenders should treat this domain as confirmed malicious. Immediate actions include blocking the domain and its resolving IP at the network perimeter, monitoring for connections to 172.67.136.27, and reviewing logs for any prior interactions. While the exact phishing kit or targeted brand is not identified, the presence of a login page and widespread detection warrant proactive containment. Further analysis of endpoint or proxy logs may reveal additional indicators of compromise linked to this campaign.