kf[.]ognnwn[.]com

This domain, kf.ognnwn.com, poses a high-risk brand impersonation threat by mimicking Microsoft Outlook’s login interface. The page title, "Outlook - Inicio de sesión," is designed to deceive users into entering credentials, which are then harvested for unauthorized access to accounts or further malicious activity. Analysis indicates the domain is actively targeting Spanish-speaking users, leveraging a familiar login format to increase the likelihood of successful credential theft. The infrastructure supports persistent phishing operations, with no indications of takedown or remediation at this time.

Evidence confirms the domain’s malicious intent through multiple technical indicators. VirusTotal reports 20 out of 95 security vendors flagging kf.ognnwn.com as malicious, while it resolves to the IP address 87.106.100.91. The domain is registered through IONOS SE and currently holds an SSL certificate issued by Let’s Encrypt (YR1), which, while legitimate, is frequently abused by threat actors to lend false credibility. It appears on one security blocklist and is actively blocked by at least one anti-phishing system, reinforcing its classification as a high-risk threat.

Users who have visited kf.ognnwn.com or entered credentials on the site should immediately take corrective action. Change all passwords associated with the compromised account, particularly if the same credentials are reused across multiple platforms. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor financial and communication platforms for unusual activity, as stolen credentials may be exploited for fraud or further phishing campaigns. Organizations should consider blocking the domain and its associated IP address (87.106.100.91) at the network level to prevent further exposure.