kora-show[.]com

The domain kora-show.com is currently active and returns HTTP 200 responses. It is hosted behind Cloudflare’s network (IP 104.21.53.89) with the service located in Canada. Registration details show the domain was created on 10 April 2026 through GoDaddy.com, LLC and uses Cloudflare’s authoritative nameservers alina.ns.cloudflare.com and decker.ns.cloudflare.com. The site presents an SSL certificate issued by Google Trust Services under the WE1 root, indicating proper TLS termination. The page title observed in the HTTP response is the Arabic phrase “كورة شو kora show مباريات اليوم تويتر جوال yalla shoot”, which does not correspond to a legitimate brand and aligns with the generic_phishing classification. Independent scanning on VirusTotal recorded detections by 7 of 94 security vendors, and the domain appears on a single blocklist, where it is listed by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, further supporting malicious intent. No additional evidence such as payload samples, redirect chains, or credential‑harvesting pages has been published, so the full scope of the phishing campaign remains unknown. Defenders should block network traffic to 104.21.53.89, add kora-show.com to URL filtering lists, and monitor for related domains that resolve to the same Cloudflare edge. Continuous re‑assessment is advised as the infrastructure may change behind Cloudflare’s CDN.