kevinnotanother[.]com

This domain, kevinnotanother.com, is actively engaged in credential theft operations designed to harvest sensitive user data, including financial login credentials and personally identifiable information (PII). Analysis indicates the site employs deceptive landing pages that mimic legitimate banking or financial service portals, leveraging social engineering tactics to trick victims into submitting confidential details. While no specific drainer kit or brand impersonation has been conclusively identified, the infrastructure and behavioral patterns align with credential harvesting campaigns targeting retail banking customers. Infrastructure analysis reveals the following technical indicators: the domain was registered on June 12, 2026, through TUCOWS.COM, CO., and currently resolves to the IP address 173.44.141.221. Security vendor assessments on VirusTotal flag the domain as malicious, with 19 out of 95 engines detecting threats. The domain appears on one security blocklist and is actively blocked by enterprise-grade threat intelligence platforms. The SSL certificate is issued by ZeroSSL GmbH under the ZeroSSL RSA DV SSL CA 2 intermediate authority, a common choice for both legitimate and malicious sites due to its low-cost, automated issuance process. As of the latest assessment, kevinnotanother.com remains active and continues to pose an elevated risk to users. Immediate response actions include advising network administrators to block the domain and associated IP at the perimeter, while end-users should be cautioned against interacting with any communications or links tied to this infrastructure. Despite existing detections, the domain may evade some security controls due to its recent registration and dynamic content delivery. Organizations are recommended to monitor for related indicators, such as subdomains or newly registered lookalike domains, and to implement multi-factor authentication (MFA) to mitigate credential theft risks.