ahhhh[.]pe[.]kr

The domain ahhhh.pe.kr is currently classified as a high‑risk generic phishing site. Public records show the domain was created on 2002‑03‑06 and resolves to the IPv4 address 110.45.144.173, which belongs to AS3786 LG DACOM Corporation located in South Korea. The authoritative name servers are ns5.new21.net and ns6.new21.net, and the site serves HTTP responses with status code 200. No TLS certificate is presented, indicating the site operates without encryption.

The page title observed for the site is "E v e r y d a y T r i p *", suggesting a possible travel‑related lure, though the exact content of the page has not been examined. Google Safe Browsing flags the URL under the SOCIAL_ENGINEERING category, and VirusTotal reports that 18 out of 95 scanned security vendors have flagged the domain as malicious. Independent blocklists, including PhishDestroy and PhishingDB, have listed the domain, and it appears on two additional security blocklists.

Reputation services assign extremely low trust scores: Scamadviser scores the site 1/100, and Gridinsoft rates it 0/100. AlienVault OTX records the domain in 19 threat‑intelligence pulses, reinforcing the view that the infrastructure is actively used in phishing campaigns. These multiple independent detections across reputable sources provide strong corroboration of the domain’s malicious intent.

Defenders should prioritize immediate blocking of ahhhh.pe.kr at perimeter devices, DNS filters, and endpoint protection solutions. Continuous monitoring of the associated IP address 110.45.144.173 and the hosting name servers is advised, as the infrastructure may be reused for additional phishing sites. Because the specific phishing kit or the exact victim‑targeted brand has not been disclosed, threat‑hunters should treat any traffic to this domain as suspicious and investigate related log entries for credential capture attempts.