kg-granit[.]pl

PhishDestroy identifies kg-granit.pl as a credential theft domain operating under a brand impersonation scheme targeting unsuspecting buyers of granite materials in Poland. The site leverages a fraudulent replica of a legitimate Polish supplier to harvest login credentials and payment information from victims. Given its active status and the absence of detection across leading security platforms, this domain poses a credible threat to users seeking construction or decorative stone products online. This domain was flagged by PhishDestroy’s automated pipeline due to suspicious infrastructure indicators and mismatched branding signals. Domain metadata reveals it was registered on March 26, 2026 through Hosting Concepts B.V., resolving to IP 188.114.96.3 with a valid Let’s Encrypt SSL certificate—common tactics to appear trustworthy. VirusTotal currently shows 0 detections out of 95 engines, indicating a low public profile despite suspicious behavior. No known inclusion on major blocklists (e.g., PhishTank, OpenPhish, Spamhaus) suggests this campaign may be newly launched or narrowly targeted. Mitigation for users encountering kg-granit.pl involves immediate avoidance: do not click, do not enter any credentials or payment details, and disconnect from the site. Organizations should monitor DNS logs for access attempts to this domain and update threat intelligence feeds to include 188.114.96.3. If credentials were submitted, users must rotate passwords immediately and enable multi-factor authentication on all related accounts. Browser extensions like uBlock Origin can block future access, while DNS filtering solutions should block both the domain and IP to prevent reinfection. Proactive reporting to CERT or abuse channels is encouraged to expedite takedown efforts.