kokatat[.]weebly[.]com

This domain, kokatat.weebly.com, is identified as a phishing site designed to harvest user credentials through a fake identity verification scheme. Analysis of the page title, CONFIRME SU IDENTIDAD, indicates the campaign targets Spanish-speaking victims, likely impersonating a legitimate service to prompt users into submitting sensitive personal or financial information. No specific brand impersonation or crypto drainer kit signatures were detected, but the generic credential harvesting approach remains effective for broad targeting. Infrastructure analysis reveals the domain was registered on April 26, 2026, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. The site resolved to the IP address 74.115.51.8, hosted by Weebly, Inc. in the United States. At the time of assessment, VirusTotal reported 20 out of 95 security vendors flagging the domain as malicious. The domain appeared on a single security blocklist, PhishDestroy, and was not listed in Google Safe Browsing. The SSL certificate was issued by Let's Encrypt, serial number E8, providing HTTPS encryption to lend false legitimacy to the phishing page. The domain is currently offline, reducing immediate risk to potential victims. However, the infrastructure remains a concern due to the use of a widely abused hosting platform and a reputable registrar, which may facilitate rapid redeployment. The elevated risk level is justified by the domain's recent creation, confirmed malicious activity, and moderate detection rate. Users are advised to treat any prior interactions with this domain as compromised and to monitor accounts for unauthorized access. Organizations should update blocklists to include this domain and investigate related indicators for potential campaign linkages.