m[.]kinqroyalgirisim2026[.]icu

This assessment covers the domain m.kinqroyalgirisim2026.icu, which is currently active as of July 21, 2026, and has been identified as involved in generic phishing activity. The domain is classified as high risk based on several technical threat indicators. It has been flagged by one security blocklist, specifically PhishDestroy, and is reported as malicious by 2 out of 95 vendors on VirusTotal. The detection by multiple, independent threat intelligence sources significantly increases confidence in its association with phishing.

The domain resolves to IP address 104.21.28.115 and is registered through Dynadot Inc. DNS is managed via Cloudflare nameservers (ines.ns.cloudflare.com and santino.ns.cloudflare.com), which is a common infrastructure pattern for both legitimate and malicious operations. The domain was registered on July 21, 2026—the same day as this report—suggesting a newly created web property. The registration timing, combined with immediate blocklist and vendor detections, is a notable risk factor consistent with phishing campaigns that leverage fresh domains to evade early detection.

At this stage, the exact content of the domain has not been independently analyzed, and no specific brands or lures are indicated from the available intelligence. Defenders should treat this domain as a credible threat. Immediate blocking at the network perimeter is strongly advised. Security teams are encouraged to monitor for related infrastructure and to update detection signatures accordingly. Continued observation is warranted, as further malicious uses or changes in associated infrastructure are possible. All findings are based on concrete technical evidence available as of the report date.