kermitwifhat[.]world

The domain kermitwifhat.world is currently active and serves a credential phishing campaign. The site returns HTTP 403 and presents the page title “Just a moment…”, indicating that the front‑end is likely a gatekeeper or challenge page. It is protected by a Google Trust Services / WE1 SSL certificate, which provides valid TLS but does not mitigate the malicious intent. DNS resolution points to 172.67.167.157, an IP owned by Cloudflare (AS13335) located in the United States, and the authoritative nameservers are linda.ns.cloudflare.com and evan.ns.cloudflare.com, confirming that the infrastructure is fully hosted behind Cloudflare’s network.

Registration data shows the domain was created on 11 December 2025 through OwnRegistrar, Inc., suggesting a relatively recent deployment. Security telemetry indicates the domain appears on one blocklist and is actively blocked by PhishDestroy; Gridinsoft assigns a trust score of 0 / 100, and two of ninety‑five VirusTotal scanners have flagged the domain as malicious, reinforcing the suspicion of phishing activity. Detected technologies include Cloudflare Browser Insights, Cloudflare, and HTTP/3, which are typical for fast‑forwarding traffic but do not reveal additional payload details.

The primary unknowns are the exact phishing landing page content, the credential collection mechanism, and any potential payloads hosted beyond the initial challenge page, as the current page title provides no functional insight. Defenders should add kermitwifhat.world to outbound URL blocklists, enforce DNS sink‑hole rules for its IP address, monitor Cloudflare‑associated traffic for anomalous authentication attempts, and consider sharing the indicator set with upstream threat‑intel platforms. Continuous re‑scanning on VirusTotal and inclusion in internal SIEM correlation rules are recommended to detect any evolution of the campaign.