apps-kiloex[.]xyz

apps-kiloex.xyz was registered with Dynadot LLC on 15 April 2026 and is currently delegated to the Cloudflare nameservers blair.ns.cloudflare.com and keanu.ns.cloudflare.com. The domain’s creation date places it among recent infrastructure deployments observed in early‑2026 phishing campaigns. Its authoritative DNS resolves to the Cloudflare edge address 172.67.222.217, which is geolocated to Canada and operated by Cloudflare, Inc. Network analysis shows the server presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E8). Despite the presence of a certificate, HTTP requests return a 403 status code, indicating intentional access restriction, a pattern commonly used to evade automated crawlers while still serving malicious content to targeted browsers. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation system. Reputation services provide a consistent signal of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that three of ninety‑five scanning engines have flagged the domain as malicious. No additional vendor detections are recorded, suggesting limited exposure in public scanning services but sufficient evidence for classification as a high‑risk phishing vector. Given the recent registration, the use of reputable hosting and encryption services, and the observed detection metrics, the domain is assessed as a high‑risk generic phishing campaign. Defenders should add the domain to network deny lists, enforce DNS sink‑holing for the resolved IP, and monitor for any payloads served behind the 403 response. Continuous observation of the associated IP and any future changes to the DNS records is recommended to detect potential re‑hosting or escalation.