kom1[.]net

Analysis of the domain kom1.net indicates active impersonation phishing infrastructure. The site resolves to the IP address 172.67.190.67, which is hosted by Cloudflare, Inc. in Canada. DNS resolution is served by the authoritative name servers arch.ns.cloudflare.com and lola.ns.cloudflare.com. The domain was registered on April 28, 2026 through Fewmoretaps OU d/b/a Trustname.com, and the TLS certificate is issued by Google Trust Services under the WE1 designation. HTTP requests return a 200 status code, and the page title observed is "Досье и компромат • ОРД и криминал • Экономические преступления • Портал Компромат", confirming a Russian-language focus.

Threat intelligence signals include a single entry on a security blocklist and one pulse in the AlienVault OTX repository. The domain is also listed as blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, and the site currently registers zero detections out of 95 scans on VirusTotal, indicating that automated scanners have not yet flagged malicious payloads. The classification of the campaign as impersonation phishing is derived from the provided scam type, and no additional malicious payloads or credential harvesting mechanisms have been publicly disclosed.

Uncertainty remains regarding the exact content and tactics employed on the landing page, as no visual analysis is available. Defenders should prioritize monitoring DNS queries to 172.67.190.67 and enforce blocking of the domain at network edges, especially for users accessing Russian-language resources. Given the low trust score and presence on blocklists, adding kom1.net to internal blacklists and updating URL filtering policies is recommended. Continuous re‑evaluation of VirusTotal and other sandbox feeds is advised to capture any future detection changes, and security teams should remain alert to potential credential‑stealing campaigns that may leverage this infrastructure.