kittlycraft[.]com

Analysis as of July 27 2026 indicates that the domain kittlycraft.com is actively being used in a generic phishing campaign. The domain was registered on December 07 2025 through Turkticaret.net Yazılım Hizmetleri Sanayi ve Ticaret A.Ş., and its authoritative name servers are cecelia.ns.cloudflare.com and yichun.ns.cloudflare.com, pointing to the Cloudflare edge network. DNS resolution returns the IPv4 address 104.21.7.107, which belongs to Cloudflare’s infrastructure. The domain is presently listed as active and has been blocked by the PhishDestroy sinkhole.

VirusTotal reports that 18 of 91 scanned security vendors flag the domain as malicious, and it appears on one external security blocklist, reinforcing the malicious classification. The reporting platform assigns a high risk level, reflecting the potential impact of credential theft. No additional context such as page title, target brand, or SSL certificate details has been published, leaving the exact content of the hosted page unknown. Safe Browsing status is not explicitly disclosed, but inclusion on a blocklist typically triggers warning mechanisms.

No Open Threat Exchange entries have been observed, and no public TLS analysis is available, suggesting reliance on Cloudflare’s default TLS termination. The convergence of registrar information, Cloudflare hosting, multiple vendor detections, and blocklist inclusion strongly suggests that the domain is being leveraged to harvest credentials or other sensitive data. Defenders should add kittlycraft.com to DNS and URL filtering rules, monitor outbound connections to the resolved IP address 104.21.7.107, verify TLS settings, and share indicators of compromise with internal threat‑sharing platforms. Continuous re‑evaluation is advised in case the threat actor modifies the payload or redirects to alternative infrastructure.