kptlagri[.]com

Analysis of kptlagri.com shows the domain is currently active and has been identified as a generic phishing operator. The domain was registered on August 01, 2026 through Global Domain Group LLC and uses the nameservers ns1.globaldomaingroup.com and ns2.globaldomaingroup.com. DNS resolution points to the IP address 104.18.26.246, which is the sole hosting endpoint observed for this indicator. The domain appears on one public security blocklist and has been explicitly blocked by the PhishDestroy sinkhole, confirming that upstream mitigation actions are already in place.

VirusTotal has processed the domain with scans from 91 security vendors; none of the vendors reported a detection at the time of analysis, but the absence of a flag does not constitute a safety assertion. No additional telemetry such as Safe Browsing verdicts, Open Threat Exchange (OTX) references, SSL certificate details, HTTP response codes, trust‑score metrics, page title content, or external evidence links were available for this domain. Consequently, the precise content and target brand of the phishing lure remain unknown, and further investigation is required to characterize the payload and victim‑selection strategy.

Defenders should continue to enforce domain‑level blocking for kptlagri.com across DNS filters, proxy appliances, and endpoint firewalls. Ongoing monitoring of the associated IP address and its hosting provider is recommended, as well as periodic rescans with updated vendor engines to capture any emerging signatures. Adding the domain to internal threat intelligence feeds and sharing the indicator with peer organizations will improve collective detection capability while the investigation remains open.