xn--kakaocalls-9893b[.]com

The domain xn--kakaocalls-9893b.com was registered on August 15 2025 through NameCheap, Inc. It resolves to the IPv4 address 121.53.221.97, which is announced by AS18160 belonging to Kakao Corp and geolocated in South Korea. The authoritative nameservers are kianchau.ns.cloudflare.com and leia.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. Web server analysis shows an HTTP 200 response and a valid TLS certificate issued by Let’s Encrypt (certificate profile E7). The site enforces HTTP Strict Transport Security. Front‑end technologies identified include Node.js, Vue.js, and Nuxt.js, while tracking integrations such as Naver Analytics, Google Tag Manager, Facebook Pixel, and a Kakao script are present. HSTS and the use of modern JavaScript frameworks suggest a deliberately crafted infrastructure rather than an opportunistic compromise. The page title returned by the server is “카카오”, directly referencing the Kakao brand, which aligns with the generic_phishing classification. VirusTotal has flagged the domain by 1 of 95 scanners, and it appears on a single external blocklist. PhishDestroy has already added the domain to its takedown list. The combination of brand impersonation, active hosting, and the presence of multiple analytics and advertising tags elevates the risk to a high level, and the domain remains reachable as of the report date. Defenders should add xn--kakaocalls-9893b.com to URL filtering and DNS sinkhole rules, especially for environments where Kakao services are used. Continuous monitoring of the associated IP address and its ASN is advised, as the infrastructure may be reused for additional phishing campaigns. Incident response teams should treat any credential submissions to this domain as compromised and advise affected users to reset authentication tokens. Ongoing intelligence sharing with upstream blocklist providers can help accelerate takedown actions.