kaspa-ng[.]org

Analysis indicates that the domain kaspa-ng.org was registered on March 11 2026 through a publicly available registrar. It resolves to the IP address 188.114.97.3, which is owned by AS13335, a Cloudflare network located in the United States. Authoritative nameservers dora.ns.cloudflare.com and tim.ns.cloudflare.com are in use, and the site presents a valid TLS certificate issued by Google Trust Services (WE1). HTTP requests return a 200 status code and the page title is reported as “Kaspa NG”, suggesting a superficially legitimate landing page.

The infrastructure has been classified as a generic phishing site. Evidence includes a trust score of 0 out of 100 from a known reputation engine, detection by one out of ninety‑five security scanners, and inclusion on two public blocklists. Further, the domain appears in twenty‑three threat‑intel pulses on a collaborative platform, reinforcing the phishing attribution. The site’s content currently delivers a login‑style interface that mimics a legitimate service, a typical pattern for credential‑harvesting campaigns.

Despite the clear indicators, the publicly observable payload is limited to the login façade; no additional malicious scripts or file downloads have been identified. The lack of observed malware does not negate the phishing risk, but it leaves open the possibility of future payload escalation. Continuous monitoring of the domain’s DNS records and any changes to served content is advised to detect potential evolution of the threat.

Defenders should add kaspa-ng.org to network and email filtering rules, enforce TLS inspection where possible, and educate users about unsolicited login requests that reference the “Kaspa NG” brand. Threat‑intel feeds should be updated to retain the domain on blocklists, and incident response teams should treat any credential submissions to this site as compromised. Prompt remediation reduces exposure to credential theft and subsequent account takeover attempts.