ktq68[.]cc

ktq68.cc, a phishing domain, is currently offline but has been flagged as malicious by 4 out of 94 vendors on VirusTotal. Despite its current status, the domain was actively used for phishing operations, exploiting the infrastructure provided by Cloudflare, Inc., with its hosting IP located in Canada. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for its lenient registration policies.

The domain's SSL certificate was issued by Google Trust Services, indicating an attempt to appear legitimate to potential victims. This is a common tactic used by cybercriminals to gain the trust of users by mimicking secure and trusted entities. The presence of the domain on public blocklists, including PhishDestroy, highlights its previous malicious activity.

Although ktq68.cc is offline now, its brief period of activity underscores the rapid lifecycle of phishing domains. Such domains often exploit the gap between registration and detection, a window where they can operate under the radar of many security systems. PhishDestroy's early detection and inclusion on blocklists help mitigate potential damage during this critical period.