kakaohelp[.]org

Analysis as of July 25, 2026 indicates that kakaohelp.org was registered on February 24, 2026 through NameSilo, LLC. The authoritative nameservers are emily.ns.cloudflare.com and nitin.ns.cloudflare.com, pointing to Cloudflare's network. DNS resolution maps the domain to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was observed, implying the site served content over plain HTTP. The page title returned during the brief live period was “카카오톡 다운로드 - KakaoTalk Download”, a Korean-language phrase that suggests a lure targeting users of the KakaoTalk messaging application.

The domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL, and three of ninety‑three VirusTotal scanners flagged the domain as malicious. The current operational status is offline, but historical evidence confirms the domain was active enough to be indexed by security vendors. The combination of a recent registration, Cloudflare‑hosted infrastructure, lack of encryption, and the presence on multiple phishing‑focused blocklists aligns with a generic phishing campaign.

Uncertainty remains regarding the exact content served, the phishing kit employed, and whether any credential harvesting endpoints were active before takedown. Defenders should continue to block the domain and its resolving IP at perimeter and DNS filtering layers, monitor any future re‑registration attempts, and consider adding the associated IP range to threat‑intel feeds. Ongoing observation of Cloudflare‑originating abuse patterns is advised, as the infrastructure can be reused for other malicious campaigns.