kinroyal50951[.]com

This domain is flagged as a high-risk credential harvesting phishing site designed to deceive users into disclosing sensitive login credentials. Analysis indicates the domain specifically targets Turkish-speaking victims, as evidenced by the page title 'Kingroyal | Bordo Kraliyet Santrali 2026,' which references a localized theme. The threat type is classified as generic_phishing, with a focus on impersonation and social engineering tactics to extract authentication details. Infrastructure analysis reveals the domain was registered on June 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 104.21.34.55, a Cloudflare proxy endpoint commonly used to obfuscate hosting origins. Security vendor detection is minimal but notable, with 2 out of 95 vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, indicating no legitimate reputation. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Mitigation requires immediate blocking of the domain and its resolving IP (104.21.34.55) at the network perimeter. Security teams should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain name, IP, and associated SSL certificate fingerprint. User awareness training should emphasize identifying phishing lures referencing localized themes, such as the Turkish-language title observed. If credentials were entered, affected accounts must be locked, passwords reset, and multi-factor authentication enforced. Monitoring for secondary infections or lateral movement is recommended, as phishing sites often serve as initial access vectors for broader compromise.