kushkingz[.]biz

The domain kushkingz.biz has been identified as a credential theft operation targeting individuals seeking cannabis-related products. Analysis indicates the site was designed to harvest login credentials, payment details, or personal information under the guise of a legitimate retailer. As of the latest assessment, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 5.252.152.108. It employed a Let's Encrypt SSL certificate, a common tactic to appear legitimate while lacking substantive validation. The site was flagged by 3 of 95 security vendors on VirusTotal and appeared on one security blocklist. Detected technologies included WordPress, MySQL, PHP, Apache HTTP Server, and multiple JavaScript libraries (Underscore.js, Swiper, jQuery Migrate, jQuery), which are frequently exploited in phishing campaigns for dynamic content delivery. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While kushkingz.biz is currently offline, users who accessed the site should assume potential compromise of entered credentials or payment details. Immediate actions are recommended, including resetting passwords for any accounts used on the domain, monitoring financial statements for unauthorized transactions, and scanning local devices for malware. Organizations should update blocklists to include this domain and its associated IP address (5.252.152.108) to prevent future access attempts. Given the domain's recent creation date, vigilance is advised for similarly named domains that may emerge as part of this threat actor's infrastructure.