candykontrol[.]com

The domain candykontrol.com was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is presently hosted behind Cloudflare’s network (IP 172.67.188.169, CA location). The authoritative nameservers are kami.ns.cloudflare.com and terin.ns.cloudflare.com, and the site presents a valid Let’s Encrypt certificate (E8). HTTP requests return status code 200, indicating the web server is actively serving content. Analysis of public threat feeds shows the domain appears on a single security blocklist and has been flagged by PhishDestroy as active malicious infrastructure. VirusTotal scans report that 2 of 95 antivirus engines label the domain as malicious, and AlienVault OTX includes it in one pulse. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility of the site. The page title observed on the site is “Site Adresi Sorgula”, which translates to “Check Site Address”. This suggests the page is masquerading as a legitimate domain‑lookup or verification service, a common lure for credential harvesting. No definitive evidence identifies a specific brand being spoofed, so the impersonation remains uncertain, but the generic nature of the interface aligns with known generic phishing kits. Given the high risk rating, defenders should block candykontrol.com at perimeter and DNS filtering layers, incorporate the domain into threat‑intel feeds, and monitor for any related C2 traffic to the Cloudflare IP. Continuous re‑scanning with updated antivirus and sandbox environments is advised to detect any payload evolution. Organizations that rely on domain‑verification tools should educate users to verify URLs and certificate details before entering credentials.