poocoln[.]cc

Analysis of poocoln.cc reveals a recently established domain flagged for generic phishing activity, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to IP address 172.67.196.36, hosted by Cloudflare, Inc. in Canada. Infrastructure analysis indicates the use of Cloudflare nameservers (amos.ns.cloudflare.com and tricia.ns.cloudflare.com), a common tactic to obscure hosting origins and leverage Cloudflare’s CDN and security features. The detected page title, 'www.www.poocoln.cc,' suggests either a misconfiguration or deliberate obfuscation, though the exact content and target of the phishing attempt remain unconfirmed due to the domain’s current offline status.

The domain appears on at least one security blocklist, and PhishDestroy has explicitly blocked it. VirusTotal reports a single detection out of 93 security vendors, indicating limited but present awareness within the security community. No additional details regarding the phishing kit, targeted brand, or specific scam type are available in the current intelligence. The use of HTTP/3, a newer protocol, may be an attempt to evade traditional detection mechanisms or improve performance for malicious activities.

Defenders should treat this domain as elevated risk based on its registration recency, Cloudflare hosting, and existing blocklist entries. While the domain is offline, monitoring for reactivation or shifts in infrastructure (e.g., changes in IP or nameservers) is recommended. If encountered in logs or network traffic, this domain should be blocked at the perimeter, and any associated artifacts (e.g., IPs, certificates) should be investigated for further compromise indicators. The lack of widespread detection does not imply safety, and organizations should correlate this domain with other threat intelligence sources for context.