wocosuto85[.]com

The domain wocosuto85.com is currently active and classified as a high‑risk generic phishing site. Registration data indicates the domain was created through NICENIC INTERNATIONAL GROUP CO., LIMITED, and authoritative DNS is provided by ns3.my-ndns.com and ns4.my-ndns.com. The host resolves to the IPv4 address 178.16.54.222, which is assigned to Omegatech LTD in the Netherlands. An HTTPS service is presented using a Let’s Encrypt certificate (YR2). HTTP requests receive a 302 redirect and the page title returned is “Just a moment…”, suggesting a potential interstitial or verification step. The domain is listed on a single public blocklist and is also blocked by the PhishDestroy service. VirusTotal analysis shows that seven of ninety‑one scanned scanners flagged the domain, and AlienVault OTX references it in one threat‑intel pulse. Although the exact payload or credential‑harvesting page has not been publicly disclosed, the combined indicators—registrar profile, DNS configuration, redirect behavior, and modest scanner detections—support the phishing classification. Defenders should block the domain at the network perimeter, add the IP address 178.16.54.222 to deny lists, and monitor for any future activity tied to the associated nameservers or certificate. Continuous re‑evaluation is advised as additional detections may emerge.