kgenlives[.]xyz

This domain is currently offline, having been taken down after detection. The domain kgenlives.xyz was registered on 2025-10-26 through NiceNIC International Group Co., Limited and is delegated to the authoritative nameservers ns1-ams.v-sys.org and ns2-ams.v-sys.org. DNS resolution points to the IPv4 address 195.26.87.207, which belongs to AS43641 SOLLUTIUM EU Sp z.o.o. located in the Netherlands. No TLS certificate is presented for the host, indicating that any HTTP service would be delivered over clear-text connections.

The only visible page content reported is the title “Account Suspended”, which does not provide any functional service but suggests the site has been disabled. Threat intelligence records classify the activity as an Account Takeover generic phishing campaign. The domain appears on two independent blocklists – PhishDestroy and ScamSniffer – confirming that it has been recognized by external anti-phishing feeds. VirusTotal analysis shows that 4 of 95 scanning engines flagged the domain, providing additional independent confirmation of malicious intent. The limited number of detections may reflect the short operational window before the takedown.

Uncertainty remains around the specific payload or credential-stealing mechanisms employed, as no sample URLs, email templates, or victim reports have been disclosed. Defenders should continue to block the domain at perimeter firewalls and proxy filters, add the associated IP address to deny lists, and monitor for any re-registration or rapid DNS changes that could indicate a resurrection attempt. Because the site lacks SSL, any future re-appearance would be trivially observable via HTTP inspection. Ongoing vigilance in threat-intel feeds for the two blocklist identifiers and for any new VirusTotal submissions is recommended to capture potential re-use of the same infrastructure.