korashow[.]com

This domain, korashow.com, is actively hosting a credential harvesting phishing scheme disguised as a legitimate domain sale page. Analysis indicates the site presents itself as "KoraShow.com is for sale" but deploys tracking and interactive elements commonly associated with fake login portals. The infrastructure is designed to capture user credentials, session tokens, or other sensitive inputs under the pretense of a domain purchase or inquiry, a tactic frequently observed in targeted phishing campaigns. Evidence supporting this assessment includes detection by 10 out of 95 security vendors on VirusTotal, a trust score of 0/100, and registration through TurnCommerce, Inc. DBA NameBright.com. The domain resolves to IP address 54.243.117.197 and is currently blocked by at least one security blocklist. Technologies detected on the site include Microsoft ASP.NET, Adobe ColdFusion, reCAPTCHA, and Google Analytics, which are often exploited to enhance the appearance of legitimacy while facilitating data exfiltration. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. Users who have visited korashow.com or interacted with its content should immediately revoke any entered credentials, particularly if login details for email, financial services, or corporate accounts were provided. Monitor all linked accounts for unauthorized activity and enable multi-factor authentication where available. Clear browser cache and cookies to remove any stored session data. If credentials were reused across multiple platforms, reset passwords on all affected services using a unique, complex password for each. Report the incident to internal security teams or relevant authorities to support broader threat mitigation efforts.