kent72[.]run

Analysis of kent72.run shows a newly registered domain (created 11 April 2026) that is actively serving a credential phishing campaign. The site resolves to IP 92.63.227.153, which is geolocated to Poland and attributed to 3nt solutions LLP. DNS is hosted on four CloudNS nameservers (pns1‑pns4.cloudns.net). The server presents a valid Let's Encrypt certificate (E7) and responds with an HTTP 301 redirect. The page title, rendered in Russian, advertises a "Кент" casino mirror, indicating the phishing lure targets users of an online gambling service. Threat intelligence flags include two detections from 94 VirusTotal scanners, inclusion in a single blocklist, and active blocking by PhishDestroy. Gridinsoft assigns a trust score of 0/100, and registration was processed through NICENIC INTERNATIONAL GROUP CO., LIMITED. No additional content analysis is available beyond the title, so the exact phishing page layout remains unknown. Defenders should treat kent72.run as high‑risk: add the domain and its resolving IP to blocklists, monitor DNS queries for the CloudNS nameservers, and implement URL filtering rules that capture the Russian casino‑related lure. Continuous re‑scanning is advised to capture any changes in payload or hosting infrastructure.