kulpra-inv[.]com

Analysis indicates that kulpra-inv.com is currently active and resolves to the IP address 188.114.97.3. The domain was registered on December 23, 2025 through NameSilo, LLC and is hosted on Cloudflare infrastructure, as shown by its authoritative name servers brianna.ns.cloudflare.com and kyree.ns.cloudflare.com. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, confirming that at least one reputable anti‑phishing organization has identified it as malicious. VirusTotal scans show that two of ninety‑one security vendors flagged the domain, providing independent confirmation of its malicious nature.

No additional public evidence such as page title or SSL certificate details is available at this time, and the site’s content has not been publicly analysed. The relatively recent registration date combined with Cloudflare’s generic nameservers is a pattern often observed in short‑lived credential‑harvesting campaigns, and the presence on a blocklist suggests active phishing activity targeting credential collection. Defenders should immediately add kulpra‑inv.com and its resolved IP 188.114.97.3 to URL filtering and firewall deny lists. Email gateways should be configured to block any messages containing this domain or links to it.

Endpoint protection solutions should be updated to include the two vendors’ detections, and security teams should monitor threat‑intel feeds for any new indicators of compromise related to this domain. Because the hosting provider is Cloudflare, any takedown request should be directed through Cloudflare’s abuse reporting channel, referencing the blocklist entry from PhishDestroy. Continuous monitoring of the domain’s DNS records is advised, as attackers may shift to alternate IPs or create additional domains using the same registrar. Users should be educated to verify URLs before entering credentials and to report suspicious login pages to the security team.