kpa47[.]cc

The domain kpa47.cc is currently identified as an active threat involved specifically in credential harvesting phishing. This campaign aims to deceive victims into divulging sensitive login credentials, representing an elevated risk to user security. No specific brand impersonation has been confirmed in this case, but the threat remains significant due to its credential targeting nature.

This domain resolves to the IP address 104.21.80.131 and was registered via NICENIC INTERNATIONAL GROUP CO., LIMITED on April 25, 2025. VirusTotal analysis reveals that 6 out of 95 security vendors have flagged this domain, indicating a measurable but not overwhelming consensus on its malicious intent. The domain holds an SSL certificate issued by Google Trust Services, which could be used to feign legitimacy during phishing attempts. Currently, there are no specific mentions of blocklist counts or additional trust scores beyond the VirusTotal flags.

Given its active status and elevated risk level, users and network defenders should treat any interactions with kpa47.cc with extreme caution. It is advised to block or restrict access to this domain where possible and educate users on recognizing credential phishing tactics. Monitoring related network traffic for connections to IP 104.21.80.131 can assist in early detection. Continued threat intelligence updates and domain reputation checks are recommended to mitigate the potential impact of this credential harvesting operation.