# ks998.cc — MALICIOUS

> ks998.cc is flagged as a medium-risk phishing domain. It is currently offline, but users should remain cautious and avoid interacting with it.

## Summary
PhishDestroy identifies ks998.cc as a generic phishing threat, posing risks by potentially stealing user credentials or sensitive information. Such phishing sites are dangerous because they exploit trust to harvest data, which can lead to identity theft or financial loss. The medium risk level indicates a significant threat that users should not ignore.

The domain ks998.cc was registered recently on March 12, 2026, through GoDaddy.com, LLC and resolves to the IP address 104.21.40.25. It appears on one security blocklist and has been flagged by 5 out of 95 security vendors in VirusTotal scans. Currently, the site is offline, which may limit immediate harm but does not guarantee the domain will remain inactive.

Users are advised to avoid accessing ks998.cc or providing any personal information if encountered. Employing updated security software and browser filters can help block similar phishing attempts. Always verify the legitimacy of sites before entering sensitive data, and consider reporting suspicious domains to security platforms like PhishDestroy for ongoing monitoring.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 0)
- Page title: KS

## Domain Intelligence
- Registered: 2026-03-12 17:07:01
- Registrar: GoDaddy.com, LLC
- Country: US
- IP: 104.21.40.25
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: demi.ns.cloudflare.com woz.ns.cloudflare.com
- SSL Issuer: none

## Detection Status
- VirusTotal: 5 vendors flagged
  Vendors: ["alphaMountain.ai", "Forcepoint ThreatSeeker", "Gridinsoft", "LevelBlue", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce2c7-fe0e-7710-9881-68f6b758120a.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/d0c056f1-a35c-4748-ba5a-778cd1c81931
- PhishDestroy: https://phishdestroy.io/domain/ks998.cc/
- LLM endpoint: https://phishdestroy.io/domain/ks998.cc/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/ks998.cc/
Last updated: 2026-03-19