kpab10[.]cc

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed to mimic legitimate banking login portals. Analysis indicates the infrastructure is actively used for credential harvesting and financial fraud operations targeting unsuspecting users. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain kpab10.cc was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.96.3 and is protected by Cloudflare, which is commonly exploited to obscure hosting origins. Security vendors have flagged this domain, with 12 out of 95 engines on VirusTotal detecting malicious activity. The domain appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100, indicating no credibility. The SSL certificate is issued by Google Trust Services, which, while legitimate, is often leveraged by threat actors to lend false authenticity to phishing sites. Additionally, the page title krab10.cc suggests a possible typo-squatting variant, further increasing the risk of user deception. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address 188.114.96.3 at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to kpab10.cc or its aliases. End users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly financial or sensitive accounts. Security teams should monitor for indicators of compromise, such as unusual login attempts or unauthorized transactions, and conduct a forensic review of systems that accessed the domain. Given the domain's current offline status, continuous monitoring for reactivation or similar domains registered through the same registrar is recommended.