# PhishDestroy domain threat record: kokirimarae.org.nz Content language: English Canonical HTML report: https://phishdestroy.io/domain/kokirimarae.org.nz/ Machine-readable companion: https://phishdestroy.io/domain/kokirimarae.org.nz/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-10 22:28:16 UTC - Last availability or vendor check: 2026-10-22 10:14:37 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 6/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 43.245.52.70 - Registrar in stored WHOIS data: Dreamscape Networks International Pte Ltd t/a Crazy Domains - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2011-03-11 01:49:47 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a127ed-7e36-7452-aa91-297ee3151abf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/kokirimarae.org.nz - Certificate Transparency search: https://crt.sh/?q=%25.kokirimarae.org.nz - Web Archive lookup: https://web.archive.org/web/*/https://kokirimarae.org.nz/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview kokirimarae.org.nz is a New Zealand .org.nz domain on the PhishDestroy blocklist. PhishDestroy first saw it on 2026-10-11, and it has not yet been assigned to a specific scam category. It currently shows a page titled "Future website of kokirimarae.org.nz", which is the kind of placeholder a host displays before a real site goes up. The site was still online with live content on 2026-10-19. How the scam works The page title points to an unfinished or parked site, while the domain sits on our blocklist and is flagged by several security vendors. That title does not match the listing. A placeholder page can be swapped for different content at any time without the address changing, so a domain flagged this way can later serve malicious pages to visitors. Until a scheme is confirmed, treat any login form, download or wallet-connection request on this domain as hostile. Evidence VirusTotal checked the domain on 2026-10-12, and 6 of 92 engines flagged it: alphaMountain.ai, AutoShun, Gridinsoft, SOCRadar, URLQuery and Webroot. That is a minority of engines, but the flags come from vendors that use different detection methods, which makes them more meaningful than a single isolated hit. The domain also appears in 3 AlienVault OTX threat pulses, so other researchers have tied it to suspicious activity. PhishDestroy is the only blocklist listing it so far. Infrastructure The domain was registered on 2011-03-11, more than fifteen years before PhishDestroy flagged it. That points to an established name rather than a throwaway registration made for a campaign. It is registered through Dreamscape Networks International Pte Ltd t/a Crazy Domains and hosted on Dreamscape Networks Limited infrastructure in Australia, a common setup for small Australasian websites. An older domain with recent security flags is often a sign of a lapsed, re-registered or compromised name. What to do If you visited this domain, do not return, and do not enter passwords, personal details or payment information. If you already typed credentials there, change that password and any reused copies, then turn on two-factor authentication. If you downloaded a file, delete it and run a malware scan. Defenders should block the domain at DNS and the web proxy, search logs for connections since 2026-10-11, and keep watching it in case the placeholder is replaced with active content. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a127ed-7e36-7452-aa91-297ee3151abf/ VirusTotal report: https://www.virustotal.com/gui/domain/kokirimarae.org.nz Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=kokirimarae.org.nz Archived copy: https://web.archive.org/web/20260127100138/http://kokirimarae.org.nz/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:39:43 UTC ## Stored page captures - Primary capture: https://i.ibb.co/fY6MVq18/81cda4875855.png Captured: 2026-10-10 22:28:16 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a127ed-7e36-7452-aa91-297ee3151abf.png Captured: 2026-10-10 22:28:16 UTC Source report: https://urlscan.io/result/01a127ed-7e36-7452-aa91-297ee3151abf/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b50cc1a5-3222-4912-9438-334da95de50a.png Captured: 2026-10-12 11:34:39 UTC Source report: https://radar.cloudflare.com/scan/b50cc1a5-3222-4912-9438-334da95de50a SHA-256: 364fa6c7c4673f11df8ab7b995409b69cca2ac574b6fc6aeb8cc31e80e933f51 - URLQuery: https://screenshots.phishdestroy.io/uq/054d8afd-1ca1-494a-8a3f-953bd522346f.png Source report: https://urlquery.net/report/054d8afd-1ca1-494a-8a3f-953bd522346f SHA-256: c6cdc103c0f138a11854e53e6407ed755e20347dd7f4a89b9ed8f85b4cbbcdf3 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127d3-c55b-75ba-b7e7-4845928a1c64.png Captured: 2026-10-10 21:59:18 UTC Source report: https://urlscan.io/result/01a127d3-c55b-75ba-b7e7-4845928a1c64/ SHA-256: b57b75e1b9ca39cd8e0020df90db8cac2193f3ee4ef6b353af8fbf2e83c32e36 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127e0-06af-70c9-8508-9acac7600cc7.png Captured: 2026-10-10 22:12:41 UTC Source report: https://urlscan.io/result/01a127e0-06af-70c9-8508-9acac7600cc7/ SHA-256: 8bd239a8117fb955a5c81bb9fcb74d4b0424f5929903fc812c653b54205c2e68 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a127e4-7c4f-73a0-9ee0-39293772c4ac.png Captured: 2026-10-10 22:17:35 UTC Source report: https://urlscan.io/result/01a127e4-7c4f-73a0-9ee0-39293772c4ac/ SHA-256: 1e4c0d9c1909441380e41e70e38859c72d44399cc23789bb0598bc8e46c23a70 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T18:33:30Z", "uuid": "01a127ed-7e36-7452-aa91-297ee3151abf", "scanned_at": "2026-10-10T22:27:25Z", "final_url": "http://kokirimarae.org.nz/", "status": 200, "redirects": [ { "to": "https://kokirimarae.org.nz/", "from": "http://kokirimarae.org.nz/", "status": 307 }, { "to": "http://kokirimarae.org.nz/", "from": "https://kokirimarae.org.nz/", "status": 307 } ], "ip": "43.245.52.70", "ptr": "testpanel.co.nz", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com" ], "ips": [ "142.250.195.163", "142.250.183.42", "43.245.52.70" ], "asns": [ "15169", "38719" ], "countries": [ "US", "AU" ], "link_domains": [ "www.freeparking.co.nz", "newfold.com" ], "doc_hash": "05136b206727dcdd73cc3cd1b45da1ab53fad84a915ff2da516bbb1d53be0880", "domain_age_days": 3391, "apex_age_days": 3391, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 69, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx/1.22.1", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T18:45:00Z", "uuid": "b50cc1a5-3222-4912-9438-334da95de50a", "scanned_at": "2026-10-12T11:34:39Z", "final_url": "https://kokirimarae.org.nz/", "history": [ { "url": "https://kokirimarae.org.nz/", "status": 0 } ], "dom_hash": "433a5e367a2aeb4769756ee4cc70d4ffb3e81ed2c2fddf9de5834d9d14dd2a4d", "domain_risks": [ "Parked & For Sale Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "kokirimarae.org.nz", "type": "A", "value": "43.245.52.70" } ], "dnssec_valid": false, "whois": { "registrar": "Dreamscape Networks International Pte Ltd t/a Crazy Domains", "created": "2011-03-11T02:49:47Z", "updated": "2026-03-19T05:07:14Z", "nameservers": [ "ns.freeparking.co.nz", "ns2.freeparking.co.nz" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-21T02:38:42Z", "analysis_at": "2026-10-20T21:05:40Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 5, "suspicious": 1, "undetected": 32 }, "detections": { "Webroot": "malicious", "AutoShun": "malicious", "SOCRadar": "phishing", "Gridinsoft": "suspicious", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Dreamscape Networks International Pte Ltd t/a Crazy Domains", "created": "2011-03-11T02:49:47Z", "updated": "2026-03-19T05:07:14Z", "first_seen": "2023-11-27T07:21:12Z", "dns": [ { "ttl": 300, "type": "MX", "value": "alt1.aspmx.l.google.com", "priority": 10 }, { "ttl": 300, "type": "MX", "value": "aspmx.l.google.com", "priority": 1 }, { "ttl": 3600, "type": "NS", "value": "ns2.freeparking.co.nz" }, { "ttl": 300, "type": "MX", "value": "alt2.aspmx.l.google.com", "priority": 10 }, { "ttl": 300, "type": "MX", "value": "alt3.aspmx.l.google.com", "priority": 20 }, { "ttl": 300, "type": "A", "value": "43.245.52.70" }, { "ttl": 3600, "type": "SOA", "rname": "admin.syrahost.com", "value": "ns.freeparking.co.nz" }, { "ttl": 3600, "type": "NS", "value": "ns.freeparking.co.nz" }, { "ttl": 300, "type": "MX", "value": "alt4.aspmx.l.google.com", "priority": 20 } ], "dns_at": "2026-10-20T21:06:04Z", "cert": { "san": [ "autodiscover.kokirimarae.org.nz", "cpanel.kokirimarae.org.nz", "kokirimarae.org.nz", "mail.kokirimarae.org.nz", "webdisk.kokirimarae.org.nz", "webmail.kokirimarae.org.nz", "www.kokirimarae.org.nz" ], "issuer": "Let's Encrypt / Let's Encrypt Authority X3", "serial": "31dda78c8bb74edba3db4ead4b273ba1d24", "sha256": "e68ba1bf9621a6fb87b9733e44449be89ccc992ebe6c34dd3fe269533924d6e7", "subject": "kokirimarae.org.nz", "valid_to": "2019-08-21T18:52:24Z", "valid_from": "2019-05-23T18:52:24Z" }, "whois": { "registrar": "Dreamscape Networks International Pte Ltd t/a Crazy Domains", "registrar_url": "https://www.crazydomains.com.au/", "created": "2011-03-11T02:49:47Z", "updated": "2026-03-19T05:07:14Z", "status": [ "ok" ], "nameservers": [ "ns.freeparking.co.nz", "ns2.freeparking.co.nz" ], "dnssec": "unsigned" } } } ```