thekebabsnop[.]com

This domain, thekebabsnop.com, is identified as a credential harvesting phishing site designed to deceive users into disclosing sensitive login credentials. Analysis indicates the infrastructure mimics legitimate authentication portals, likely targeting users of financial services, email providers, or corporate platforms. The domain employs social engineering tactics, such as spoofed login pages, to capture usernames, passwords, and potentially multi-factor authentication codes, which are then exfiltrated to attacker-controlled servers for unauthorized access or financial fraud. Evidence supporting this assessment includes detection by 5 out of 95 security vendors on VirusTotal, with the domain registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 27, 2026. It resolves to the IP address 188.114.97.3, a Cloudflare-protected endpoint utilizing HTTP/3 and Amazon Web Services for hosting. The domain appears on one security blocklist and has been documented in a single threat intelligence pulse on AlienVault OTX. The use of Let's Encrypt SSL certificates further suggests an attempt to appear legitimate, while the domain's creation date aligns with recent phishing campaign timelines observed in similar credential theft operations. Users who visited thekebabsnop.com or entered credentials on any page hosted under this domain should immediately revoke and reset all exposed passwords, particularly for accounts associated with financial services, email, or corporate systems. Enable multi-factor authentication where available and monitor accounts for unauthorized activity. Organizations should block the domain and its resolved IP (188.114.97.3) at the network perimeter, while endpoint security solutions should be updated to detect and prevent access to this infrastructure. If credentials were submitted, assume they are compromised and take proactive steps to secure affected accounts, including notifying relevant security teams or service providers.