santanderweb[.]dothome[.]co[.]kr

Analysis on santanderweb.dothome.co.kr, observed as active on 2026-08-05, confirms it operates as a phishing infrastructure. The domain resolves to the IPv4 address 112.175.185.138 and is hosted on the dothome.co.kr name-server set (ns1, ns11, ns2, ns3.dothome.co.kr). Registration details show the domain was created on 2004-03-05 through Inames Co., Ltd., a Korean registrar, suggesting the registration predates the observed malicious activity. Reputation data indicates the domain appears on three independent phishing blocklists—PhishDestroy, OpenPhish, and Phishunt—demonstrating consensus among threat-intelligence feeds that the site is abusive.

VirusTotal scans report 22 of 91 security vendors flagging the domain as malicious, reinforcing the blocklist findings. No additional technical artefacts such as SSL certificate details, HTTP response codes, or page-title information are presently available, leaving the exact content and delivery mechanisms unverified. The lack of visible page metadata means defenders cannot rely on content signatures, but the convergence of IP resolution, blocklist inclusion, and vendor detections provides sufficient confidence to treat the domain as high-risk.

Mitigation recommendations include adding the domain and its resolved IP address to network deny lists, configuring web-proxy filters to block HTTP(S) requests to the domain, and monitoring for any future DNS changes. Continuous re-evaluation is advised, as the domain's long registration age may allow the operators to shift hosting or employ fast-flux techniques. Organizations should also consider sharing any observed traffic with relevant industry ISACs to improve collective detection.