vks[.]kestory[.]com

The domain vks.kestory.com is identified as a generic phishing threat targeting users with a deceptive page title. The page mimics a legitimate McDonald's Deutschland announcement, suggesting a new loyalty program for regular customers. This approach is typical in phishing campaigns designed to lure unsuspecting users into providing sensitive information.

Infrastructure analysis reveals that vks.kestory.com resolves to the IP address 185.81.114.38 and uses a Let's Encrypt SSL certificate. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com on May 19, 2026. The Gridinsoft trust score for this domain is 0/100, indicating a high level of distrust. VirusTotal reports that 6 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The domain is currently offline, which suggests that it has been taken down or is no longer active.

Despite the domain being taken offline, the infrastructure and registration details suggest a well-coordinated phishing campaign. Security researchers recommend monitoring for any reactivation of the domain and ensuring that network defenses are updated to block traffic to 185.81.114.38. The remaining risk is moderate, as the domain could be reactivated or repurposed for future phishing activities. Users are advised to remain vigilant and report any similar suspicious activities to their security teams.