ksi-games[.]forum

Analysis of the domain ksi-games.forum indicates it is an active phishing infrastructure registered on June 12, 2026, through NAMECHEAP INC. The domain resolves to IP address 172.67.196.191, which is part of a content-delivery network known for masking origin servers. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3 protocol, alongside a Let's Encrypt SSL certificate, which collectively obscure the true hosting location and complicate takedown efforts. As of July 12, 2026, the domain appears on two security blocklists and has been included in 16 threat intelligence pulses on AlienVault OTX, suggesting recurring malicious activity. Detection engines PhishDestroy and BLP-Malware have flagged the domain, while five of 95 security vendors on VirusTotal classify it as malicious. The Gridinsoft trust score of 0/100 further corroborates the high-risk classification. The exact content and targeted brand or service remain unconfirmed, as the domain's page title and specific phishing kit have not been analysed. Defenders are advised to block the domain and its resolving IP at network perimeter controls, monitor for credential theft attempts linked to this infrastructure, and report the domain to registrar abuse contacts for potential suspension. Given the domain's recent registration and continued activity, ongoing monitoring is recommended.