kimdirkim[.]com

This domain, kimdirkim.com, is actively flagged as part of a credential phishing operation. Registered on March 7, 2026, through a large commercial registrar, the domain currently resolves to the IP address 185.106.210.202. Infrastructure analysis reveals the use of Nginx and OpenResty, common components in web server setups that may be leveraged for hosting phishing content or redirecting victims. The SSL certificate is issued by Let's Encrypt, a widely used certificate authority, which does not inherently indicate malicious intent but is frequently employed in phishing campaigns to lend a false sense of legitimacy to fraudulent sites. The domain appears in 23 threat intelligence pulses on a public threat-sharing platform, suggesting repeated detection by security researchers. It is also present on two security blocklists, including entries from PhishDestroy and BLP-Malware, further corroborating its association with malicious activity. A VirusTotal scan indicates that 10 out of 95 security vendors flag the domain as malicious, though the absence of detections from the remaining vendors does not rule out the possibility of ongoing abuse. The page title 'One moment, please...' is consistent with temporary holding pages or cloaking techniques used to evade automated detection while awaiting deployment of phishing content. Defenders should treat this domain as high-risk based on its active status and confirmed presence in multiple threat intelligence sources. The domain's relatively recent registration date and continued resolution to a live IP address suggest it remains operational for malicious purposes. Network security teams are advised to block traffic to and from 185.106.210.202 and monitor for any attempts to access kimdirkim.com within their environments. While the specific phishing kit or targeted brand has not been identified, the infrastructure's configuration aligns with known phishing tactics, warranting proactive mitigation measures.