notificationst-001-site1[.]ktempurl[.]com

Analysis of notificationst-001-site1.ktempurl.com shows that the domain was registered through Tucows Domains Inc. on January 20, 2024 and is currently taken offline. The site presented a default page title of "Default Page" and lacked an SSL certificate, indicating an unencrypted HTTP service. Network resolution points to IP address 208.98.35.107, which is assigned to AS46844 Sharktech in the United States. The domain is served by the nameservers ns1.site4now.net, ns2.site4now.net, and ns3.site4now.net, a configuration commonly observed in disposable‑hosting setups.

VirusTotal scans flagged the domain in 13 of 95 security vendor engines, and the domain appears on a single public blocklist. Additional reputation signals include a Gridinsoft trust score of 0 out of 100 and explicit blocking by the PhishDestroy service. The threat classification is credential phishing, consistent with the observed lack of TLS and the generic default page.

While the domain is offline, its infrastructure—particularly the hosting IP and nameserver set—remains reusable for future malicious campaigns. Defenders should add the domain and its resolving IP to network deny lists, enforce TLS‑only outbound policies to prevent clear‑text connections, and monitor for re‑registration of the same hostnames or similar subdomains under the same nameserver cluster. Updating intrusion‑detection signatures with the observed indicator set (domain, IP, nameservers, and blocklist presence) will improve early detection of any resurgence.