kikisfinance[.]live

On 24 July 2026 analysts observed the domain kikisfinance.live serving a page titled “Welcome to | Kikis Finance”. The site was hosted on IP 192.3.190.186, an address allocated to AS36352 operated by HostPapa in the United States. Registration records show the domain was created through OwnRegistrar, Inc., and the authoritative nameservers are ns1.managedns1.com and ns2.managedns1.com. TLS termination is provided by a Let’s Encrypt certificate (R13), indicating the site used HTTPS despite its later offline status. Threat intelligence flags the domain as a brand‑impersonation campaign targeting Google.

Eight of ninety‑five antivirus and URL‑reputation engines on VirusTotal reported the domain as malicious, and the site is listed on at least one public blocklist. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious classification. PhishDestroy has already taken the domain offline and added it to its blocklist, confirming active mitigation. Evidence confirms that the page title references “Kikis Finance”, which does not match the Google brand, suggesting the operators attempted to lure victims with a financial‑themed lure while exploiting Google’s reputation. The precise phishing kit, credential‑capture mechanism, or malicious payload has not been disclosed, leaving those aspects uncertain.

Likewise, no Safe Browsing or Open Threat Exchange entries were observed in the supplied data. Defenders should continue to block the resolved IP address and the domain at DNS and proxy layers, update intrusion‑detection signatures with the eight vendor detections, and monitor the registrar OwnRegistrar, Inc. for any re‑registration attempts. Because the TLS certificate is publicly trusted, future iterations could reuse the same certificate chain, so certificate pinning where feasible is advised. Continuous observation of the associated nameservers may reveal new domains that reuse the same hosting infrastructure.