kpkgg6[.]com

This domain, kpkgg6.com, is confirmed as a credential theft phishing site impersonating the RadioFM brand, a legitimate radio streaming application for Android, iPhone, and web platforms. The site mimics the official RadioFM privacy policy page, likely to harvest login credentials, payment details, or other sensitive user information under false pretenses. No direct evidence of a crypto drainer kit was observed, but the use of tracking technologies and analytics suggests data exfiltration capabilities consistent with credential theft operations. Infrastructure analysis reveals the domain was registered on October 31, 2025, through DYNADOT LLC, with hosting resolved to IP address 35.181.19.220. The site employs Node.js, Nginx, and Express for backend operations, alongside Google Tag Manager and Google Analytics for user tracking. Security vendor assessments on VirusTotal flag the domain as malicious by 13 out of 95 engines. The domain appears on three security blocklists and is referenced in four AlienVault OTX threat intelligence pulses. The SSL certificate is issued by Google Trust Services, and HSTS is enforced, likely to lend an air of legitimacy to the fraudulent site. As of the latest assessment, kpkgg6.com has been taken offline, reducing immediate exposure to end users. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Organizations should maintain blocklist entries for this domain and monitor for any re-emergence. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and review financial statements for unauthorized activity. The risk of credential reuse across platforms amplifies the potential impact of this campaign.