khx-group[.]com

The domain khx-group.com is a confirmed phishing site engaged in brand impersonation, specifically targeting Google users. It operated as a tech-support scam, presenting fraudulent alerts or login prompts designed to deceive victims into divulging credentials or installing malicious software. No crypto drainer kit was identified. The site is currently taken offline, but prior activity posed an elevated risk to users who may have interacted with it.

Technical indicators confirm khx-group.com as malicious. As of analysis, 1 of 95 VirusTotal security vendors flagged the domain, including Fortinet. The domain was registered on July 02, 2024, through Atak Domain Bilgi Teknolojileri A.S. and resolved to the IP address 198.23.190.194, hosted on AS36352 (HostPapa) in the US. It appeared on 1 security blocklist, PhishDestroy, while Google Safe Browsing did not flag it. The SSL certificate was issued by R11, and the observed page title was khx-group.com. Trust scores from Gridinsoft and Scamadviser were 0/100 and 1/100, respectively.

Users who visited khx-group.com should immediately change any passwords entered on the site, particularly for Google or other sensitive accounts, and enable two-factor authentication. Monitor accounts for unauthorized activity and report any suspected fraud to the Federal Trade Commission or local cybercrime authorities. To report the domain, submit it to Google Safe Browsing, PhishTank, or the registrar Atak Domain Bilgi Teknolojileri A.S. for further action.