kuromionsol[.]lol

Analysis of the domain kuromionsol.lol shows it was registered on February 03, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently pointing to the IP address 172.67.196.66. The domain is hosted on Cloudflare infrastructure, as indicated by its authoritative nameservers penny.ns.cloudflare.com and scott.ns.cloudflare.com. The domain remains active as of the report date (July 22, 2026) and has been listed on a single security blocklist. It is also blocked by the PhishDestroy service, suggesting that at least one anti‑phishing feed has identified it as malicious.

VirusTotal records indicate that the domain has been scanned by 95 antivirus and URL‑reputation vendors, with no detections reported at the time of analysis; however, the absence of detections does not constitute confirmation of safety. No public SSL/TLS details, HTTP response codes, page titles, or content snapshots are available, so the exact nature of the hosted page cannot be confirmed. The lack of observable page‑level indicators means that the precise phishing lure or credential‑capture mechanism remains unknown.

Defenders should treat kuromionsol.lol as a high‑confidence phishing indicator based on its blocklist presence, Cloudflare hosting, and registration characteristics. Recommended actions include adding the domain and its resolved IP (172.67.196.66) to network‑level deny lists, monitoring DNS queries for the domain, and flagging any outbound connections to the associated IP. Continuous re‑evaluation is advised, as future scans or threat‑intel feeds may reveal additional artifacts such as page content, SSL certificates, or malicious payloads.