khampt[.]com

This domain, khampt.com, is flagged as a credential harvesting phishing site designed to deceive users into submitting sensitive authentication details. Analysis indicates the infrastructure is engineered to mimic legitimate login portals, likely targeting corporate or financial service credentials. The site employs evasion techniques such as Cloudflare protection to obscure its malicious intent and delay detection by security systems. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on November 19, 2025, through Spaceship, Inc., a registrar frequently associated with short-lived phishing campaigns. It resolves to the IP address 172.67.137.19 and is detected by 6 out of 95 security vendors on VirusTotal, including explicit phishing classifications. The domain appears on one security blocklist and has been assigned a trust score of 0/100, further corroborating its malicious nature. Technologies detected include Cloudflare and HTTP/3, which are commonly exploited to mask hosting origins and accelerate malicious payload delivery. Users who visited khampt.com or interacted with its content should take immediate remediation steps. All credentials entered on the site must be considered compromised and reset across all platforms where identical or similar passwords were used. System scans using updated endpoint protection should be conducted to detect potential malware or browser-based persistence mechanisms. Network traffic logs should be reviewed for connections to 172.67.137.19 or related domains registered through Spaceship, Inc. Organizations should update their security policies to block this domain and its associated IP at the perimeter level to prevent further exposure.