theokocat[.]org

The domain theokocat.org was registered on February 21, 2026 through NiceNIC International Group Co., Limited and currently resolves to the Cloudflare‑owned address 104.21.16.94 (AS13335, United States). The site returns HTTP 200 and serves a WordPress stack with MySQL, PHP, Yoast SEO, jQuery, and is protected by Cloudflare, including support for HTTP/3. The presented SSL certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid TLS handshake. The page title returned by the server is “Okocat litter Premium Website”, which suggests an attempt to masquerade as an Okocat service, although no further branding is observed in the available metadata.

The domain is listed on a single public blocklist, PhishDestroy, and is flagged by two of ninety‑five VirusTotal scanners, indicating that at least some security products have identified malicious characteristics. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation. The site’s infrastructure relies on Cloudflare’s DNS, using the nameservers khalid.ns.cloudflare.com and nancy.ns.cloudflare.com, which complicates direct host‑level takedown but does not prevent network‑level blocking. Current intelligence does not reveal the specific phishing kit, credential‑capture mechanisms, or target audience; the content of the page beyond the title has not been harvested.

Defenders should add the IP address 104.21.16.94 and the domain name to outbound filtering rules, monitor DNS queries for the associated Cloudflare nameservers, and ensure that URL filtering solutions reference the PhishDestroy blocklist entry. Given the active status, high risk rating, and low trust score, organizations should treat any traffic to theokocat.org as malicious and instruct users to avoid interaction. Ongoing collection of page content and any observed credential‑phishing payloads would improve attribution and response actions.