bookkooks[.]com

This domain, bookkooks.com, has been confirmed as a credential theft phishing site designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the infrastructure and detected technologies suggest a broad targeting approach typical of credential harvesting campaigns. The site employs social engineering tactics to trick users into submitting sensitive information, which is then exfiltrated to attacker-controlled servers. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 28, 2026, through Fewmoretaps OU d/b/a Trustname.com. It resolves to the IP address 208.109.20.54 and is currently associated with a Let's Encrypt SSL certificate. The domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal. Detected technologies include WordPress, MySQL, PHP, Apache HTTP Server, jQuery Migrate, jQuery, Google Tag Manager, and Google Analytics, which are commonly exploited to facilitate phishing operations. As of the latest assessment, bookkooks.com has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future malicious activity. The registrar and hosting provider have not publicly disclosed remediation actions, leaving residual risk for users who may have interacted with the site prior to its takedown. Organizations are advised to block the domain and associated IP at the network level, monitor for indicators of compromise, and educate users on recognizing credential theft attempts. The elevated risk level justifies continued vigilance, particularly for entities whose users may have been exposed to the phishing campaign.