kg[.]aliexpressboost[.]com

kg.aliexpressboost.com was registered on 14 March 2026 through the registrar Ultahost, Inc. The domain resolves to the IPv4 address 176.126.165.192 and uses the hoster.kg name servers ns9.hoster.kg and ns10.hoster.kg. A VirusTotal query shows that the domain has been submitted to 91 antivirus and URL scanners, none of which returned a detection result at the time of analysis. The same domain appears on a single public blocklist curated by PhishDestroy, which classifies it as malicious. No additional public reputation services, such as Google Safe Browsing, have published a verdict.

The site is currently reachable and marked as active, but no detailed page metadata (title, SSL certificate details, HTTP status code) have been published in the available intelligence. Consequently, the precise nature of the hosted content remains unconfirmed beyond the generic phishing classification supplied. The limited evidence suggests a newly created infrastructure that may be used to harvest credentials or redirect victims to fraudulent services. Defenders should block DNS resolution for kg.aliexpressboost.com at the network perimeter, add the domain to URL filtering policies, and monitor outbound connections to the associated IP address 176.126.165.192.

Continuous re‑scanning on VirusTotal and other sandbox services is recommended to capture any subsequent payloads or changes in behavior. Organizations should also consider reviewing logs for recent access attempts to the domain and enforce multi‑factor authentication for accounts that could be targeted by credential‑stealing campaigns. The threat is currently listed as under investigation, and further analysis is required to determine the full scope of the campaign.