kingroyalresmiguncelgiris[.]com

Analysis as of July 29, 2026 shows that the domain kingroyalresmiguncelgiris.com was registered through Fewmoretaps OU d/b/a Trustname.com and first observed on April 23, 2026. The domain is delegated to Cloudflare nameservers (donald.ns.cloudflare.com and zita.ns.cloudflare.com) and resolves to the IPv4 address 130.12.180.243. Current threat intelligence classifies the infrastructure as an active generic phishing operation with an elevated risk rating.

The domain appears on one public security blocklist and is specifically blocked by the PhishDestroy feed, indicating that at least one anti‑phishing service has taken automated mitigation action. VirusTotal scans have recorded four positive detections out of 91 security vendors, confirming that multiple independent scanners have flagged the domain as malicious. No additional public data such as SSL certificate details, HTTP response codes, Safe Browsing verdicts, or page title information have been released, leaving those vectors unverified at this time.

Defenders should add the domain and its resolving IP address (130.12.180.243) to network‑level deny lists, monitor DNS query logs for any lookups to the associated Cloudflare nameservers, and enforce outbound filtering that blocks traffic to this host. Continuous re‑evaluation is advised, as the lack of comprehensive web‑level indicators means the threat could evolve or expand its payload delivery methods. Organizations employing threat‑intel enrichment should correlate the domain’s activity with internal logs to detect any attempted credential harvesting or malicious redirects that may be associated with the observed phishing campaign.