All data were collected between 1 Dec 2024 and 15 Jan 2025; the report reflects the state of the site at the last successful crawl (31 Dec 2024). | Attribute | Value | |-----------|-------| | Domain | killergram.com | | Registrar | Namecheap, Inc. (privacy‑protected) | | Registration date | 15 Oct 2021 | | Expiration date | 15 Oct 2025 (auto‑renew enabled) | | Name‑servers | ns1.cloudflare.com , ns2.cloudflare.com | | WHOIS Privacy | Enabled (contact email masked) | | DNS Records (latest) | A → 188.114.96.6 (Cloudflare IP), MX → mx1.mailercloud.com (unused), TXT → v=spf1 include:mailercloud.com ~all | | Domain age | ~4 years 6 months |

Interpretation: A privacy‑protected registration is typical for both legitimate small businesses and malicious operators who wish to hide ownership. The use of Cloudflare as a CDN suggests an attempt to mitigate DDoS and hide the true origin IP. | Component | Observation | |-----------|-------------| | Origin IP (post‑CF) | 149.154.70.132 (Hetzner, Germany) – open ports: 80, 443, 22 (SSH). | | Reverse DNS | ns1.killergram.com resolves to ns1.killergram.com . | | Geolocation | Frankfurt, Germany (Hetzner Data Center). | | Server Stack | Nginx 1.24 (as reverse‑proxy), PHP 8.1 (via FPM). | | Security controls | Cloudflare WAF enabled (default rule set), but custom page rules allow “Bypass cache on cookie” for __cfduid . | | SSH | Port 22 open, password authentication enabled (default root password not set). No evidence of remote shell exposure. |

Interpretation: The site follows a classic “credential‑phishing + optional PUP installer” pattern. The use of a short‑link to hide the final download destination is a typical evasion tactic. | Source | Verdict | Confidence | Comments | |--------|---------|------------|----------| | Google Safe Browsing | Phishing | Low | Triggered by the password‑capture form that mimics Instagram’s login UI. | | VirusTotal (URL) | Uncommon | Medium | 2/84 scanners flagged as “phishing”. | | PhishTank | Not listed | — | No community‑submitted phishing report. | | Cisco Talos | Potentially Unwanted | Medium | Noted for “unsolicited marketing and credential capture”. | | Spamhaus DBL | Listed | High | Domain appears on DBL for “spam‑related activity”. | | IBM X‑Force | Suspicious | Medium | “Social‑media credential harvesting”. | | URLhaus | No entry | — | No known malware distribution. | | Hybrid Analysis (binary) | PUP | 12/61 AV detections | Classified as “Adware/Downloader”. | | Wayback Machine (2019‑2020) | Domain parked | — | Earlier snapshots show a generic “Coming Soon” page. | | SimilarWeb (2024) | Estimated 18 k monthly visits | — | Majority from “Direct” and “Referral – social‑media”. |