kakaochat[.]io

Analysis of the domain kakaochat.io indicates it is an active phishing infrastructure targeting users through impersonation of Japan Registry Services Co., Ltd. The domain was registered on March 13, 2026, via PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 104.21.9.158. The page title explicitly displays 'Japan Registry Services Co., Ltd.', suggesting an attempt to deceive visitors into believing the site is an official registry service portal. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and automation. The domain has been flagged in two threat intelligence pulses on AlienVault OTX, reinforcing its association with malicious activity. As of July 12, 2026, the site remains active, and no detections were reported by the 95 vendors that scanned it on VirusTotal. The absence of detections does not confirm safety, as phishing domains often evade initial detection through obfuscation or delayed payload delivery. The infrastructure analysis reveals no additional details about the specific phishing kit or targeted user actions, but the page title alignment with a legitimate registry service is a strong indicator of credential harvesting or fraudulent administrative requests. Defenders should treat this domain as high-risk for phishing operations. Network-level blocking of 104.21.9.158 and the domain itself is recommended. Organizations should monitor for connections to this infrastructure, particularly from systems interacting with domain registration or DNS management services. Further investigation into the hosting provider and associated domains may uncover additional related infrastructure. No brand-specific targeting beyond Japan Registry Services Co., Ltd. is confirmed at this time.