korea79[.]net

This domain, korea79.net, is flagged as a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the site mimics legitimate login pages, likely targeting users of Korean-language services or platforms, with the intent to capture usernames, passwords, and potentially multi-factor authentication codes. The domain employs social engineering tactics, such as urgency or fabricated security alerts, to coerce victims into entering sensitive information, which is then exfiltrated to attacker-controlled infrastructure. Evidence supporting this assessment includes detection by 4 out of 95 security vendors on VirusTotal, with the domain appearing on 1 security blocklist. Infrastructure analysis reveals the domain was registered on April 24, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with low-reputation domains. The domain resolves to the IP address 188.114.96.3 and uses a Let's Encrypt SSL certificate, which, while providing encryption, does not validate the legitimacy of the site. Additionally, the domain was found in 1 threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. Users who have visited korea79.net or entered credentials on the site should immediately take corrective action. Reset passwords for any accounts accessed through the domain, prioritizing those linked to financial services, email, or administrative privileges. Enable multi-factor authentication where available, using app-based or hardware tokens rather than SMS-based methods. Monitor accounts for unauthorized activity, including logins from unfamiliar locations or devices. If financial information was entered, contact relevant institutions to report potential fraud and request transaction monitoring. Clear browser caches and stored credentials to prevent automated re-exposure, and consider scanning the device for malware using updated security tools.