kingai[.]cc

Kingai.cc was registered on June 27 2025 through Gname.com Pte. Ltd. The domain resolves to IP 47.254.92.136, which is assigned to AS45102 Alibaba (US) Technology Co., Ltd. The hosting stack uses Nginx with HTTP Strict Transport Security enabled and a Vue.js front‑end. The site presented the page title “ETH Mining”, indicating a lure related to cryptocurrency mining. The TLS certificate is issued by Let’s Encrypt (R13), confirming the use of a free, automated certificate. VirusTotal scans recorded six detections out of ninety‑three scanners, showing that multiple antivirus engines flagged the domain as malicious.

Independent reputation services gave the domain a Gridinsoft trust score of 0 / 100, and it appears on two public blocklists. PhishDestroy and ScamSniffer actively block the domain, reinforcing its classification as a phishing resource. The site is currently offline, but the combination of registrar data, hosting details, observed technologies, and multiple vendor detections provides sufficient evidence to label the domain as a confirmed phishing site targeting users interested in Ethereum mining.

The exact payload or credential‑harvesting mechanism remains unknown because only the page title has been captured. Defenders should continue to block the domain at DNS and network perimeter, monitor the IP address for any re‑activation, and consider adding the associated IP range to threat‑intel feeds. Ongoing observation of the hosting provider and registrar may reveal additional malicious domains that reuse the same infrastructure.