kokhan-auto[.]com[.]ua

This domain, www.kokhan-auto.com.ua, is flagged as a high-risk credential phishing site targeting users of auto-related services. Analysis indicates the site impersonates a legitimate auto business, using the page title 'Головна. KOKHAN Auto' to deceive visitors into submitting sensitive information such as login credentials or payment details. No specific drainer kit signatures have been identified, but the domain exhibits characteristics consistent with generic phishing infrastructure, including the use of Let's Encrypt SSL certificates to appear legitimate. Infrastructure analysis reveals the following technical indicators: the domain is detected by 1 out of 95 security vendors on VirusTotal, suggesting limited but present malicious recognition. It resolves to the IP address 116.202.224.229, registered through ТОВ 'ХОСТІНГ УКРАЇНА' on October 20, 2025. The domain employs Nginx as its web server and enforces HSTS, which may be leveraged to enhance the appearance of legitimacy. The SSL certificate is issued by Let's Encrypt, a common tactic among phishing sites to evade browser security warnings. As of the latest check, the domain remains active and is not currently listed on Google Safe Browsing or major blocklists, though this may change as detection improves. The domain's current status is active, and no takedown actions have been observed. Users are advised to block the domain and its associated IP (116.202.224.229) at the network level, particularly in environments where auto-related services or Ukrainian-language content are accessed. Organizations should monitor for credential submission attempts originating from this domain and educate users on recognizing phishing indicators, such as mismatched SSL certificates or unsolicited login prompts. Despite the low initial detection rate (1/95), the domain's active status and targeted phishing theme warrant continued monitoring and proactive mitigation.