ks998[.]cc

Analysis of the domain ks998.cc indicates it is a generic phishing site with elevated risk, currently offline as of July 24, 2026. The domain was registered on March 12, 2026, through GoDaddy.com, LLC, and is associated with Cloudflare nameservers (demi.ns.cloudflare.com and woz.ns.cloudflare.com). It resolves to the IP address 104.21.40.25, hosted on AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected, which is atypical for legitimate services but common in phishing infrastructure.

The domain appears on one security blocklist (PhishDestroy), and five of 94 security vendors on VirusTotal flagged it as malicious. The page title 'KS' provides limited insight into the specific target or brand impersonation, though detected technologies include Facebook Pixel and Cloudflare Browser Insights, suggesting an attempt to mimic platforms associated with these services. The use of Cloudflare hosting and analytics tools may be an effort to lend credibility to the phishing site, though this is a known tactic among threat actors. The domain's creation date and rapid appearance on blocklists further support its classification as part of a phishing campaign.

Defenders should treat this domain as untrustworthy. Network-level blocking of 104.21.40.25 and monitoring for related domains registered through GoDaddy with Cloudflare nameservers may help mitigate further exposure. Given the lack of SSL and the domain's offline status, no immediate user interaction is expected, but historical logs should be reviewed for prior access attempts. The exact phishing lure or targeted brand remains unconfirmed due to limited content analysis, though the presence of Facebook Pixel warrants heightened scrutiny for social media-themed credential harvesting.