kntara[.]click

This domain, kntara.click, was observed hosting a page titled “Yüzyılın Konut Projesi”. The site was registered on December 01, 2025 through Global Domain Group LLC and is hosted on Cloudflare infrastructure, resolving to IP address 104.26.8.23 which belongs to AS13335 (Cloudflare, Inc.) in the United States. The authoritative nameservers for the zone are dahlia.ns.cloudflare.com and sterling.ns.cloudflare.com, confirming the use of Cloudflare's DNS service. No TLS certificate is presented, indicating the site was served over plain HTTP at the time of analysis. The domain received a Gridinsoft trust score of 0 out of 100, reflecting a severe lack of reputational confidence.

Threat intelligence sources list the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service. AlienVault OTX references the domain in sixteen separate threat‑intelligence pulses, and VirusTotal recorded detections from nineteen of ninety‑five scanning engines, reinforcing the malicious classification. The domain’s current HTTP status is offline, which may indicate takedown by the hosting provider or temporary removal by the operators. Because the site does not present an SSL certificate, any credentials submitted would have been transmitted unencrypted, a common characteristic of low‑skill phishing campaigns.

The presence on a single public blocklist, together with the PhishDestroy block, suggests that at least one anti‑phishing consortium has catalogued the site, but broader ecosystem awareness may still be limited. The sixteen OTX pulses provide historical context that the domain has been active in malicious campaigns for several months. Defenders should add kntara.click to network‑level deny lists, enforce DNS‑based blocking, and monitor for any resurgence of the domain or related Cloudflare‑hosted IPs.