snapshot-pomkori[.]com

This domain, snapshot-pomkori.com, is flagged as a brand impersonation threat targeting Instagram users through a fraudulent page titled Kori The Pom. Analysis indicates the site was designed to harvest login credentials by mimicking legitimate social media authentication flows, a common tactic in credential theft campaigns. No specific drainer kit signatures were identified, but the infrastructure aligns with typical phishing-as-a-service operations. Infrastructure analysis reveals the domain was registered on July 12, 2025, through Hello Internet Corp and resolved to IP 188.114.96.3 (AS13335 Cloudflare, Inc.). The SSL certificate was issued by Google Trust Services (WE1), a pattern observed in both legitimate and malicious Cloudflare-hosted sites. VirusTotal detection shows 9/95 security vendors flagging the domain, while two blocklists—PhishDestroy and ScamSniffer—have explicitly listed it. The domain's creation date and rapid inclusion in blocklists suggest a short-lived, high-velocity phishing operation. As of the latest verification, snapshot-pomkori.com has been taken offline, likely due to hosting or registrar enforcement. However, residual risk remains for users who may have interacted with the site prior to its removal. Organizations should monitor for credential reuse attempts and consider proactive password resets for accounts tied to the targeted brand. Network defenders are advised to block the domain and associated IP at perimeter controls, while end users should verify social media URLs directly through official applications or bookmarks.