kookor[.]com

kookor.com is currently under investigation for posing as a generic login or credential-harvesting page, potentially targeting unsuspecting users with deceptive forms. PhishDestroy identifies this domain as a high-priority threat due to its active status and lack of detection on VirusTotal despite suspicious behavior patterns. The site’s infrastructure supports malicious activity, evidenced by its low trust metrics and recent operational timeline. This domain was flagged with 0 detections out of 95 scanners on VirusTotal as of the latest scan. It is registered through Gname.com Pte. Ltd., resolves to IP 172.67.221.122, and was created on April 26, 2015. Despite its age, the domain shows recent malicious intent, likely repurposed or compromised for phishing. The SSL certificate issued by Google Trust Services does not validate the domain’s legitimacy, as threat actors often exploit trusted issuers to appear credible. No public blocklist inclusion was observed at the time of assessment, indicating either evasion tactics or an early-stage campaign. Mitigation for this threat requires immediate action: users should avoid interacting with kookor.com, especially any login or input forms. System administrators should block the domain at the network level using DNS or firewall rules targeting 172.67.221.122 and kookor.com. If credentials were entered, users must reset passwords immediately and enable multi-factor authentication on all associated accounts. Report the domain to your antivirus vendor, threat intelligence platforms, and relevant CERT teams using seed identifier 11b611 for tracking. Monitor network traffic for outbound connections to this IP to detect potential compromise. Avoid relying solely on SSL certificates as indicators of safety, as malicious domains frequently abuse trusted issuers.