kakaotalks[.]to

The domain kakaotalks.to is currently classified as a high‑risk generic phishing site. It was created on 15 August 2025 and remains active as of the report date 12 July 2026. The site is listed on one security blocklist and has been blocked by PhishDestroy, indicating that it is being used to harvest credentials or other sensitive information. Infrastructure analysis shows the domain is registered through NameCheap, Inc. and resolves to IP 121.53.221.97, which belongs to AS18160 Kakao Corp located in South Korea. The authoritative name servers are kianchau.ns.cloudflare.com and leia.ns.cloudflare.com, both hosted on Cloudflare. The web server returns HTTP 200 and presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of valid HTTPS. Technical fingerprinting reveals a modern JavaScript stack: Node.js, Vue.js and Nuxt.js are detected, together with Naver Analytics, Google Tag Manager, Facebook Pixel and a Kakao integration. The page title returned by the server is “카카오”, directly referencing the Korean messaging brand. VirusTotal reports a single detection out of 95 scanners, suggesting limited but confirmed malicious activity. While the observable indicators confirm phishing intent, the exact content of the site, credential‑capture mechanisms, and any post‑exploitation behavior have not been captured in this analysis. No additional malware detections or payloads are associated with the IP address at this time, and the low VirusTotal count may reflect limited exposure rather than benign intent. Defenders should add kakaotalks.to to URL filtering and DNS block lists, monitor traffic to the associated IP range, and enforce TLS inspection to detect any credential‑submission attempts. Continuous re‑scanning with multiple antivirus engines is recommended to capture any future changes in detection rates. Organizations using the Kakao brand should educate users about unsolicited login requests originating from this domain.