kookor03[.]com

On July 24, 2026, the domain kookor03.com was observed to host a counterfeit cryptocurrency exchange front‑end. The site presented the page title “Kookor.com – Secure and Innovative Cryptocurrency Trading Platform,” indicating an attempt to masquerade as a legitimate trading service. Registration data show the domain was created on April 9, 2026 through the registrar Name SRS AB. The authoritative nameservers are lara.ns.cloudflare.com and zahir.ns.cloudflare.com, and DNS resolution points to the Cloudflare edge address 172.67.157.1, which belongs to ASN 13335 (Cloudflare, Inc.) and is geolocated in the United States. The TLS certificate is issued by Let’s Encrypt (certificate identifier YE1), confirming the use of a free SSL certificate rather than a brand‑specific PKI.

Threat‑intelligence feeds corroborate the malicious nature of the domain. AlienVault OTX lists the domain in a single pulse, and VirusTotal recorded four detections out of ninety‑one scanned security vendors. The site is also present on three external blocklists and has been explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering services. Independent reputation scoring assigns a Gridinsoft trust score of zero out of one hundred, reflecting a complete lack of trust.

The current HTTP status is offline, which may indicate that the operator has taken the site down or is rotating infrastructure. While the available data confirm the domain’s association with a fake cryptocurrency exchange, the exact phishing kit, credential‑capture mechanisms, and any victim payloads remain undisclosed because the page content has not been captured. Consequently, defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the host under different subdomains, and update detection signatures with the observed identifiers (IP address 172.67.157.1, Let’s Encrypt certificate YE1, and the page title).