k3p9a[.]top

The domain k3p9a.top is currently active and classified as a high‑risk generic phishing site. The page title returned by the server is “MWBE-AOAY”, which does not correspond to any known legitimate service, indicating that the content is likely crafted for malicious purposes. The domain was created on July 31, 2025 and remains reachable as of the report date, July 12, 2026.

Infrastructure analysis shows the domain resolves to the IPv4 address 188.114.96.3, hosted within the Cloudflare network (AS13335). The IP is geolocated to the United States. DNS resolution is delegated to Cloudflare’s authoritative name servers cloe.ns.cloudflare.com and morgan.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the “WE1” designation, indicating the use of a valid TLS certificate issued by a major public CA.

Threat‑intelligence feeds report that k3p9a.top appears on one security blocklist and has been blocked by PhishDestroy. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of trust. Google Safe Browsing flags the domain for “SOCIAL_ENGINEERING”. VirusTotal analysis shows that 14 of 95 scanned security vendors have flagged the domain, demonstrating a consensus of malicious behavior across multiple detection engines. The site employs modern web technologies including Vue.js, HTTP/3, and HSTS, all served through Cloudflare.

Defenders should treat traffic to k3p9a.top as malicious. Network controls ought to block both HTTP and HTTPS connections to the IP 188.114.96.3 and to the domain name itself. Email security gateways should add the domain to blacklists and enable real‑time URL scanning. Continuous monitoring of DNS queries for the domain and its associated name servers can provide early warning of future abuse. Given the active status and high risk rating, organizations should also consider sharing indicators of compromise with relevant threat‑sharing communities.