geokukt[.]cn

Analysis of the domain geokukt.cn shows a confirmed phishing infrastructure as of the report date 23 July 2026. The site returned HTTP 403 when accessed, indicating that the content is intentionally hidden or restricted. The page title observed in preliminary scans reads "欧亿交易所官网 - 全球顶尖的数字货币资产交易平台 - 欧 易下载," suggesting an attempt to masquerade as a cryptocurrency exchange platform. Registration records list 包头市特木鲁网络科技有限公司 as the registrar, with the domain creation timestamp of 21 February 2026.

DNS resolution points to IP address 156.226.72.149, which is assigned to AS135097 LUOGELANG (FRANCE) LIMITED and geolocated to Hong Kong. Cloudflare is the authoritative DNS provider, using the nameservers emerie.ns.cloudflare.com and guss.ns.cloudflare.com, and the service is delivering traffic over HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming the use of a legitimate certificate authority. Threat intelligence feeds have flagged the domain; six of ninety‑three VirusTotal scanners reported malicious activity, Google Safe Browsing categorises it as a social engineering threat, and PhishDestroy has blocked it.

The domain appears on a single external blocklist and received a Gridinsoft trust score of 0 out of 100, reinforcing its malicious classification. The site is currently offline, but historical evidence indicates it was employed for phishing. Defenders should continue to block the domain at perimeter firewalls, update DNS sinkhole lists with the resolved IP, monitor for any re‑registration attempts, and consider adding the associated IP range to watchlists. Ongoing surveillance of the registrar and ASN is advised to detect potential reuse of the infrastructure.