kubcheat[.]biz

kubcheat.biz is currently classified as a high‑risk generic phishing domain. The domain was registered on May 20 2026 through CNOBIN INFORMATION TECHNOLOGY LIMITED and is hosted on an IP address (158.94.210.122) that resolves to a server in the Netherlands operated by Omegatech LTD. The site presents a page titled “KubCheat” and returns an HTTP 302 redirect, a pattern commonly used to forward victims to credential‑harvesting pages.

The TLS certificate for the host is a Let’s Encrypt R12 certificate, which provides encryption but does not imply legitimacy. Reputation data show a Gridinsoft trust score of 0 / 100 and the domain appears on three public blocklists. AlienVault OTX references the domain in a single threat‑intelligence pulse, and VirusTotal reports that three of ninety‑five scanned security vendors flag the domain as malicious, indicating a low but non‑zero detection rate among scanners.

Active monitoring indicates that the domain remains reachable and is currently blocked by multiple anti‑phishing feeds, including PhishDestroy, MetaMask, and SEAL. The limited number of detections on VirusTotal suggests that some scanning engines have not yet identified malicious payloads, but the presence of the domain on blocklists and the low trust score confirm that it is being used for phishing‑related activity. No additional payload or campaign details have been publicly disclosed, leaving the exact phishing vector (e.g., credential‑stealing form, malicious download) uncertain.

Defenders should treat any traffic to kubcheat.biz as malicious. Network controls ought to block the domain at the DNS and proxy layers, and endpoint solutions should flag the associated IP address (158.94.210.122) as high‑risk. Users should be warned against entering credentials on any pages served from this host, and security teams should continue to monitor VirusTotal and other reputation feeds for changes in detection rates that may indicate new payloads or campaign evolution.