xn--kx-4ja[.]app

The domain xn--kx-4ja.app was registered on February 27, 2026 through NiceNIC International Group Co., Limited. It resolves to the IP address 45.141.102.184, which belongs to AS48347 JSC Mediasoft ekspert and is geolocated in Russia. The authoritative name servers for the zone are a.dnspod.com and c.dnspod.com, both operated by the DNSPod service. HTTP probing returned a 403 Forbidden page title, indicating that the web server is actively refusing access to the requested resource. The underlying web server software was identified as Nginx, and no SSL/TLS certificate was presented, meaning the site is only reachable via unencrypted HTTP.

Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist. VirusTotal analysis recorded five detections out of ninety-three scanned security vendors, confirming that at least a subset of scanners consider the domain malicious. PhishDestroy has already taken the domain offline, and its current status is listed as offline. The evidence collectively points to a generic phishing infrastructure that was active for a brief period before being taken down.

Defenders should add xn--kx-4ja.app to network deny lists, block traffic to 45.141.102.184 at the perimeter, and monitor DNS queries for the associated dnspod name servers. Because the site lacks TLS, any attempted credential capture would have occurred over cleartext HTTP, underscoring the importance of enforcing strict HTTPS‑only policies. Continuous monitoring of threat‑intel feeds for additional indicators tied to this IP range or registrar may reveal related campaigns. In environments where the domain has already been resolved, ensure that cached DNS entries are purged to prevent inadvertent reconnection to the offline host.