koesux[.]com

This domain is flagged as a high-risk credential phishing endpoint designed to harvest user authentication details, including usernames, passwords, and session tokens. Analysis indicates the infrastructure is optimized for impersonating legitimate login portals, likely targeting corporate or financial services. The phishing pages hosted on koesux.com employ dynamic content loading and obfuscated JavaScript to evade detection and mimic trusted interfaces, increasing the likelihood of successful credential compromise. Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain koesux.com is registered through Fewmoretaps OU d/b/a Trustname.com and was created on May 30, 2026, suggesting a recent deployment for malicious purposes. It resolves to the IP address 69.67.173.34, hosted in Romania under AS399629 (BL Networks). VirusTotal reports 5 out of 95 security vendors have detected this domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (YE2), a common tactic to lend false legitimacy to phishing sites. Users who have visited koesux.com or entered credentials on any page hosted under this domain should immediately take corrective action. Reset all passwords associated with accounts accessed during the visit, particularly those for financial, email, or corporate services. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor account activity for suspicious logins or transactions, and report any anomalies to the respective service providers. If corporate credentials were exposed, notify the organization’s security team for further investigation and containment.