docusnok[.]dn3[.]co

Analysis indicates that docusnok.dn3.co is an active malicious infrastructure used for generic phishing. The domain resolves to the IPv4 address 172.67.142.187 and is hosted on Cloudflare infrastructure, as evidenced by the authoritative name servers jihoon.ns.cloudflare.com and mallory.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, which is typical for Cloudflare‑protected sites and does not imply legitimacy. Google Safe Browsing currently classifies the domain with the SOCIAL_ENGINEERING tag, confirming its use in credential‑stealing campaigns. WHOIS data shows the domain was created on 12 September 2022 and was registered through the registrar Porkbun; no further ownership details are disclosed. VirusTotal has recorded detections from 17 of 91 scanned scanners, indicating a moderate to high confidence of malicious intent. The exact phishing content, target brand, or lure employed has not been disclosed in the available intelligence, so the specific victim profile remains unknown. Defenders should block network connections to 172.67.142.187 and to the domain docusnok.dn3.co at the DNS level, update URL filtering rules to include the domain, and monitor for any outbound traffic that may attempt to contact the domain. Incident response teams should also consider adding the domain to threat‑intel feeds and alerting end‑user security awareness programs about the ongoing threat.