lklawilatfrtih[.]com

Analysis as of July 23, 2026 indicates that the domain lklawilatfrtih.com is associated with a high‑risk generic phishing campaign. The domain was registered on 16 October 2025 through DropCatch.com 1012 LLC and is delegated to the NameBright DNS nameservers ns1.namebrightdns.com and ns2.namebrightdns.com. No TLS certificate is present, meaning connections are unencrypted. The authoritative address resolves to the IPv6 host 2600:1f18:4ae:c608:1ae1:9fc3:6ee2:84dd, which is hosted in the United States under ASN 14618 owned by Amazon.com, Inc. The site is currently taken offline, but historical observations recorded the page title “NameBright – Coming Soon.” The lack of a legitimate certificate combined with a placeholder title is consistent with temporary or abandoned infrastructure used to host phishing payloads.

Detection telemetry shows that 16 of 95 security vendors on VirusTotal flagged the domain, and Google Safe Browsing has classified it as a social‑engineering threat. The domain is listed on one public blocklist and is specifically blocked by the PhishDestroy service. AlienVault OTX references the domain in 17 separate threat pulses, reinforcing its reputation as malicious. These multiple independent indicators provide strong confidence that the domain was actively used for malicious phishing activity before being removed.

Defenders should continue to block any network traffic to lklawilatfrtih.com at the DNS and IP layers, enforce TLS inspection policies to detect attempted clear‑text connections, and monitor for any resurgence of the domain or its associated IP range. Because the domain is currently offline, future re‑use is possible if the attacker re‑registers it or repoints the IP address to a new payload. Continuous watch‑list updates from PhishDestroy, VirusTotal, Google Safe Browsing, and AlienVault OTX are recommended.