fund-kr[.]net

This domain, fund-kr.net, is identified as a credential harvesting phishing site designed to deceive users into submitting login credentials or financial information. Analysis confirms the domain is currently offline, though it was actively serving malicious content prior to takedown. No legitimate brand impersonation has been conclusively linked to this infrastructure, but the generic phishing framework suggests broad targeting rather than a campaign tied to a specific entity. Infrastructure analysis reveals the domain was registered through Dominet (HK) Limited on May 14, 2025, and resolved to the IP address 45.120.80.222, hosted within AS132839 (POWER LINE DATACENTER) in Hong Kong. Security vendor assessments flagged the domain as malicious, with 13 of 95 VirusTotal engines detecting it as phishing-related. The domain appears on one security blocklist, and no SSL certificate was present during active monitoring. The page title, matching the domain name (fund-kr.net), further indicates a lack of effort to mimic a legitimate service, reinforcing its generic phishing classification. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat if reactivated. Organizations and individuals are advised to block the domain and associated IP (45.120.80.222) at the network level, monitor for related domains registered through the same registrar, and implement multi-factor authentication to mitigate credential theft risks. Security teams should review logs for prior connections to this domain and investigate any unauthorized access attempts linked to this phishing campaign.