nokos[.]id

PhishDestroy identifies a live credential theft campaign associated with the fraudulent domain nokos.id. This domain poses a direct risk of account takeover by tricking users into submitting login credentials on a spoofed platform. The threat actor likely aims to harvest credentials for financial platforms, email accounts, or other sensitive services, which could then be abused for fraud or further phishing attacks. The domain resolves to IP 153.92.10.86 and uses a Let’s Encrypt SSL certificate to appear legitimate, increasing the likelihood of user deception. This domain was flagged by PhishDestroy after being registered through PT Web Media Technology Indonesia on December 04, 2025. It currently shows 0 detections out of 95 VirusTotal scanners, indicating that mainstream security tools have not yet identified it as malicious. Given its recent creation and absence from major blocklists, users may encounter this domain unfiltered. The domain is actively resolving and hosting a phishing page designed to mimic a login portal—likely for brands or services commonly used in the region. If you have visited nokos.id, immediately change passwords used on that site and any other accounts with shared or similar credentials. Monitor accounts for unauthorized activity and consider enabling multi-factor authentication where available. Report the domain to your security team or use official abuse channels to request takedown. Avoid entering any credentials on this domain and warn others who may be targeted.