kilndistribution[.]live

This domain, kilndistribution.live, is flagged as a high-risk generic phishing site with active status as of July 12, 2026. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, it resolves to IP address 188.114.96.3 and is associated with Cloudflare infrastructure, including Cloudflare Browser Insights and HTTP/3. The page title 'Just a moment...' suggests an imitation of Cloudflare verification or interstitial pages, though no specific brand impersonation is confirmed in available data. Analysis indicates the domain appears in 23 threat intelligence pulses on AlienVault OTX and is blocked by at least two security blocklists (PhishDestroy, BLP-Malware). Six of 95 security vendors on VirusTotal flag the domain as malicious. The SSL certificate is issued by Google Trust Services, which does not inherently indicate legitimacy due to the prevalence of automated certificate issuance. Defenders should treat this domain as malicious and prioritize blocking it at DNS, proxy, and endpoint levels. Given its association with Cloudflare infrastructure, monitor for similar domains leveraging Cloudflare services for phishing campaigns. No evidence of a specific phishing kit or targeted brand is present in current intelligence, so generic phishing detection rules should apply. The domain remains active, and further analysis of payloads or redirect chains is recommended if encountered in logs.