kg365p[.]com

kg365p.com presents an elevated risk as a credential-harvesting portal masquerading as a legitimate login interface. The domain is explicitly designed to trick users into surrendering usernames, passwords, or other sensitive data into counterfeit forms, after which attackers can abuse the harvested credentials for account takeovers, financial fraud, or further phishing campaigns.

PhishDestroy identifies kg365p.com as a confirmed active threat based on multiple objective indicators: 22 out of 95 VirusTotal security vendors flagged the domain, it is listed on two separate blocklists, resolves to IP 20.2.172.20, and was created on March 13, 2026 through DYNADOT LLC with a Let’s Encrypt SSL certificate. The presence of 22 detections and two independent blocklists yields a combined risk profile rated as elevated.

To mitigate exposure to this credential-harvesting campaign, users should avoid visiting kg365p.com entirely. If a login prompt was accidentally accessed, immediately change passwords on other sites and enable multi-factor authentication where available. Enterprise defenders can block the domain at the firewall using the indicator 20.2.172.20 and file a takedown request referencing the domain age, registrar, and blocklist entries to reduce its operational window.