kingsabit[.]info

The domain kingsabit.info was registered on May 01, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. It is hosted behind Cloudflare’s network (IP 172.67.134.21, located in Canada) and presents a Let’s Encrypt/E8 TLS certificate, a common indicator of rapid deployment for fraudulent pages.

Infrastructure analysis shows the zone is served by Cloudflare name servers amalia.ns.cloudflare.com and jihoon.ns.cloudflare.com, confirming the use of a reputable CDN to obscure origin infrastructure. The domain resolves exclusively to the Cloudflare IP, limiting direct host attribution but indicating a reliance on Cloudflare’s edge services for traffic handling and potential evasion of IP‑based blocking.

Reputation signals are strong: the domain appears on a security blocklist, is flagged by PhishDestroy, and received a Gridinsoft trust score of 0 out of 100. AlienVault OTX lists the domain in one threat‑intel pulse, and VirusTotal reports six positive detections out of ninety‑five scanners, suggesting that multiple security engines have identified malicious content. An HTTP 403 response is observed, which may indicate a deliberately restricted landing page used to deliver credential‑harvesting forms after initial access.

Based on the convergence of registration, hosting, TLS, and detection data, analysts can treat kingsabit.info as a high‑confidence phishing infrastructure. Defensive teams should block the domain at DNS and proxy layers, update intrusion‑prevention signatures to include the associated Cloudflare IP, and monitor for any derivative subdomains. Continuous re‑evaluation is advised, as the active status and low trust score imply ongoing malicious activity.