kgen[.]team

Analysis of the domain kgen.team, created on February 21, 2026, shows a clear malicious profile despite its current offline state. The domain resolves to the IP address 104.21.64.67, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The TLS certificate presented is identified as WE1, indicating a generic or possibly self‑signed certificate rather than a trusted brand‑issued chain. The page title returned by the web server is "Just a moment...," a common placeholder often used in redirect or verification pages that lack substantive content.

Reputation data reveal that the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that threat‑intelligence sources have flagged it as malicious. VirusTotal analysis shows that one out of ninety‑three scanning engines flagged the domain, providing at least one independent detection. In addition, the Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a low‑trust, potentially harmful site. The combination of a newly registered domain, low trust score, blocklist inclusion, and the presence of a generic SSL certificate suggests a phishing operation, likely aimed at redirecting users to a credential‑harvesting page.

Defenders should continue to block kgen.team at network perimeter devices, update URL filtering lists, and monitor for any resurgence of activity from the associated IP address. Because the site is currently offline, further live analysis is not possible, and the exact phishing payload or target brand remains unknown. Continuous observation of the IP range and periodic re‑scanning are recommended to detect any re‑activation or related infrastructure changes.