kcn[.]co[.]com

The domain kcn.co.com is currently active and classified as a high‑risk brand‑impersonation campaign targeting Google. According to the latest intelligence (July 24 2026), the site presents the page title “AF88 Kcn - Trang Chủ Chính Thức AF88.COM - Nhà Cái Uy Tín”, which does not reference Google but the domain is listed as impersonating the Google brand. The domain was registered on 16 August 1997 through Moniker Online Services LLC and uses the nameservers ns1.nic.co.com through ns4.nic.co.com. Infrastructure analysis shows the domain resolves to 172.67.222.103, an IP owned by Cloudflare, Inc. (AS13335) located in the United States.

HTTP requests return a 301 redirect, and the TLS certificate is issued by Google Trust Services under the WE1 profile, suggesting an attempt to lend credibility to the site. Security telemetry indicates the domain appears on four blocklists – PhishDestroy, Polkadot, Enkrypt, and Codeesura – and has a Gridinsoft trust score of 0 out of 100. VirusTotal reports three detections out of ninety‑one scanned vendors, reinforcing the malicious assessment. The web stack is identified as WordPress running on MySQL and PHP, with client‑side libraries including jQuery, jQuery Migrate, HSTS, and Cloudflare Browser Insights, confirming the use of a typical content‑management platform behind Cloudflare protection.

The campaign is categorized as credential phishing, although the exact phishing vector (login page, credential‑stealing form, etc.) has not been publicly disclosed. Defenders should block the domain at DNS and proxy layers, enforce URL filtering against the listed blocklists, and monitor for any outbound connections to the associated Cloudflare IP. Incident response teams should also consider reviewing logs for attempts to access Google‑related services from internal users, as the impersonation may aim to harvest Google credentials.