kbrdirect[.]top

Analysis of kbrdirect.top shows it is an active brand impersonation campaign targeting Google. The domain was registered on April 09, 2026 through Dynadot LLC and resolves to IP 188.114.96.3, which is owned by Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare authoritative nameservers glen.ns.cloudflare.com. and joan.ns.cloudflare.com. The site presents an HTTP 302 redirect and serves a TLS certificate issued by Let’s Encrypt (E7). Security telemetry indicates the domain is listed on one blocklist and has been flagged by PhishDestroy. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports a single detection out of 94 scanning engines. The page title returned by the server is "Atto - Time Clock & Scheduling - Apps on Google Play," which does not match the declared Google impersonation but suggests the content has not been fully examined. Given the confirmed brand impersonation label, the low trust score, and the presence on a blocklist, defenders should immediately block DNS resolution to kbrdirect.top, add the IP 188.114.96.3 to network deny lists, and monitor for any traffic attempts to the domain. Continuous re‑inspection of the hosted page is advised to determine whether the site serves malicious payloads or credential‑harvesting forms.