kookor02[.]com

Analysis of the domain kookor02.com indicates it was a confirmed phishing site targeting users of cryptocurrency exchange platforms. Registered on April 9, 2026, through Name SRS AB, the domain resolved to the IP address 172.67.222.241, hosted on Cloudflare's infrastructure (AS13335) in the United States. The site presented itself with the page title 'Kookor.com – Secure and Innovative Cryptocurrency Trading Platform,' explicitly positioning itself as a cryptocurrency exchange, which aligns with the classified scam type of a fake exchange. Infrastructure analysis reveals the use of Cloudflare nameservers (lara.ns.cloudflare.com and zahir.ns.cloudflare.com) and a Let's Encrypt SSL certificate (YE1), which are common among both legitimate and malicious sites.

The domain was flagged by three security blocklists and is currently offline, suggesting remediation efforts or takedown actions. Detection by vendors such as PhishDestroy, MetaMask, and SEAL further corroborates its malicious classification, while Gridinsoft assigned a trust score of 0/100. AlienVault OTX included the domain in two threat intelligence pulses, indicating its presence in broader threat-sharing communities. While VirusTotal shows only one of ninety-one security vendors flagging the domain, this limited detection does not diminish the validity of other evidence, as detection rates can vary based on scanning timing and vendor coverage.

The domain's registration details, hosting provider, and blocklist status collectively support its classification as a phishing threat. Defenders should treat this domain as malicious and maintain blocks on related infrastructure, including the resolved IP address and associated nameservers. Further monitoring of domains registered through the same registrar or utilizing similar Cloudflare-based hosting patterns may help identify additional threats.