# PhishDestroy domain threat record: mail.kakao.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/mail.kakao.com/ Machine-readable companion: https://phishdestroy.io/domain/mail.kakao.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-14 16:40:09 UTC - Last availability or vendor check: 2026-10-22 10:29:25 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 1/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 121.53.201.132 - Registrar in stored WHOIS data: Megazone Corp., dba HOSTING.KR - Last stored HTTP status: 200 - Registration date (registry RDAP, kakao.com): 1996-12-29 05:00:00 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/mail.kakao.com - Certificate Transparency search: https://crt.sh/?q=%25.mail.kakao.com - Web Archive lookup: https://web.archive.org/web/*/https://mail.kakao.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview mail.kakao.com is a mail hostname under the kakao.com domain and appears on the PhishDestroy blocklist without a confirmed scheme classification. PhishDestroy first flagged it on 2026-09-14. When last checked on 2026-10-19, the site was online and serving live content. Anyone who signs in to Kakao Mail or a Kakao account through this address should read the evidence below before acting. How the scam works No specific scam has been established for this domain. Its page title is blank, containing only an invisible character, so the title shows neither a brand lure nor a wallet or exchange theme. The only plausible risk from a mail hostname is a login page that collects account credentials. Nothing shown here confirms that this page collects anything beyond what a normal sign-in would. Treat it as unverified, not as proven phishing. Evidence Independent support is very weak. On 2026-09-27, VirusTotal showed 1 of 91 engines flagging the domain, and that single verdict came from Forcepoint ThreatSeeker. No other blocklist besides PhishDestroy carries it. One isolated vendor hit on a long-standing service domain is the kind of signal that needs manual confirmation before anyone acts on it. Infrastructure The setup is an unusual profile for a phishing site. kakao.com was registered on 1996-12-29 through Megazone Corp., dba HOSTING.KR, nearly three decades before PhishDestroy flagged it. The site is hosted in South Korea on the Kakao Corp network, which is the brand's own infrastructure. Its TLS certificate comes from DigiCert through the Thawte TLS RSA CA G1 intermediate, a commercial chain, not a free automated one. Taken together, these details point to an established corporate service and away from a throwaway scam deployment. What to do If you reached a Kakao login through a link in an unexpected message, close that page. Sign in by typing the address yourself or by opening the official Kakao app. If you entered your password after following such a link, change it and turn on two-step verification for your Kakao account. Then review your recent login activity for sessions you don't recognize. Defenders should confirm this listing against their own telemetry before blocking it, because a hard block could disrupt legitimate Kakao Mail traffic. Any confirmed malicious content should be reported to Kakao's security team. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/mail.kakao.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mail.kakao.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:47:30 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/292e6803-399e-4bb1-8f0d-c86c0c25ca63.png Captured: 2026-09-21 12:49:07 UTC Source report: https://radar.cloudflare.com/scan/292e6803-399e-4bb1-8f0d-c86c0c25ca63 SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924 - URLScan · 2026-08-03: https://screenshots.phishdestroy.io/us/019fc7eb-0ea3-773e-8109-1280bccb683e.png Captured: 2026-08-03 13:58:25 UTC Source report: https://urlscan.io/result/019fc7eb-0ea3-773e-8109-1280bccb683e/ SHA-256: 09a97defbec19abe876e0b8a8b498ae0418d9659a90861b83b714a5268228c67 - URLScan · 2026-09-26: https://screenshots.phishdestroy.io/us/01a0dee9-08a4-735e-ab5e-1b56bcff7c02.png Captured: 2026-09-26 18:10:20 UTC Source report: https://urlscan.io/result/01a0dee9-08a4-735e-ab5e-1b56bcff7c02/ SHA-256: 09a97defbec19abe876e0b8a8b498ae0418d9659a90861b83b714a5268228c67 - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15903-f3ea-75ca-9abe-09ef2c01af0d.png Captured: 2026-10-20 11:13:39 UTC Source report: https://urlscan.io/result/01a15903-f3ea-75ca-9abe-09ef2c01af0d/ SHA-256: f9bf92b44efd2c79acd5b2454ba9a68bbb475fa7f4055ef0d0e5897a18635f31 - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a1594a-3bc9-7238-8806-3e8ba6e89e8f.png Captured: 2026-10-20 12:30:15 UTC Source report: https://urlscan.io/result/01a1594a-3bc9-7238-8806-3e8ba6e89e8f/ SHA-256: eee2a066a0455d99db39b622e64c489df3d6d6803595d7950ae859132fa14249 - URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15d63-4055-722f-9994-5f8d61e6ed86.png Captured: 2026-10-21 07:35:59 UTC Source report: https://urlscan.io/result/01a15d63-4055-722f-9994-5f8d61e6ed86/ SHA-256: 89c5389649a096ad47c0eeb11b9676ce282b52e938bf947744174d84617c0d21 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:35Z", "uuid": "292e6803-399e-4bb1-8f0d-c86c0c25ca63", "scanned_at": "2026-09-21T12:49:07Z", "final_url": "https://mail.kakao.com/", "doc_hash": "eaa9a799d75b078ca0950c36d8975fc2a21eac387d1db1bec8155f995d2ad60d" }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:53:06Z", "analysis_at": "2026-10-21T20:07:02Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 0, "undetected": 37 }, "detections": { "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "popularity": { "Cisco Umbrella": 873996 }, "registrar": "Megazone Corp., dba HOSTING.KR", "created": "1996-12-29T12:00:00Z", "expires": "2019-12-28T05:00:00Z", "updated": "2019-02-28T12:00:00Z", "first_seen": "2023-10-03T18:01:24Z", "dns": [ { "ttl": 10, "type": "A", "value": "211.249.251.30" }, { "ttl": 600, "type": "CNAME", "value": "mail-lavmkchh.kgns1.com" }, { "ttl": 156, "type": "CNAME", "value": "mail-lavmkchh.kgns1.com" }, { "ttl": 599, "type": "CNAME", "value": "mail-lavmkchh.kgns1.com" } ], "dns_at": "2026-10-21T20:12:17Z", "jarm": "29d29d00029d29d00029d29d29d29da5fc7ec76b7ed0b839211317d3844486", "cert": { "san": [ "kakao.com", "*.kakao.com" ], "issuer": "DigiCert Inc / Thawte TLS RSA CA G1", "serial": "3a1f123e9ba5235e4ae567abaac7b97", "sha256": "c84681d06f4fd41cf7d4ea55d1ec702fdf4f9754c304df70035532ad12a64b54", "subject": "kakao.com", "valid_to": "2027-03-18T23:59:59Z", "valid_from": "2026-09-01T00:00:00Z" }, "whois": { "registrar": "Megazone Corp., dba HOSTING.KR", "registrar_iana_id": "1489", "registrar_url": "http://HOSTING.KR", "created": "1996-12-29T05:00:00Z", "updated": "2019-02-28T02:03:07Z", "expires": "2019-12-28T05:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "ok" ], "nameservers": [ "ns.iwilab.com", "ns2.iwilab.com" ], "dnssec": "unsigned" } } } ```