gncaf[.]or[.]kr

This domain, gncaf.or.kr, is currently classified as a high‑risk generic phishing infrastructure. Active monitoring shows the domain resolves to the IPv4 address 52.231.65.211, which belongs to AS8075 Microsoft Corporation in South Korea. The web server returns HTTP 200 and presents the title “강릉문화재단”. Underlying technologies identified include YouTube embeds, Microsoft ASP.NET, jQuery, and HTTP Strict Transport Security. The site uses a Let’s Encrypt R13 certificate, providing encryption but not authentication of legitimacy. Reputation data indicate that seven of ninety‑five VirusTotal scanners have flagged the host, two external blocklists list the domain, and both PhishDestroy and CryptoFirewall have actively blocked it. An AlienVault OTX pulse references the domain in a single threat‑intel entry, and Gridinsoft assigns a trust score of 0 out of 100. Registration records show creation on 7 March 2008 via Inames Co., Ltd., with authoritative name servers ns1.uhost.co.kr and ns2.uhost.co.kr. While the page title appears unrelated to common phishing lures, the combination of a legitimate‑looking certificate, active blocklist entries, and multiple vendor detections suggests deliberate abuse. Defenders should add gncaf.or.kr to deny‑list policies, monitor DNS queries for the associated IP, and consider tightening outbound email filters that reference the domain. Ongoing observation is recommended to detect any content changes or additional indicators of compromise.