b47k.vip 피싱 및 보안 점검

The domain b47k.vip is currently active and resolves to the IP address 103.27.177.163. Infrastructure analysis shows that the domain is hosted on nameservers ns1.1111343.com, ns2.1111343.com, ns3.1111343.com, and ns4.1111343.com, indicating a possibly shared or disposable hosting environment. Threat intelligence sources have recorded the domain in two AlienVault OTX pulses, suggesting that it has been observed in multiple unrelated campaigns. VirusTotal data indicates that one of ninety‑one security vendors flagged the domain, providing a minimal but notable detection signal. The domain appears on a single public blocklist, specifically PhishDestroy, confirming that at least one anti‑phishing organization has taken mitigation action against it. No additional public blocklists or safe‑browsing services are listed in the available data, and no further details about page content, SSL configuration, or HTTP response codes have been disclosed. Defenders should prioritize adding b47k.vip to DNS and web‑filter deny lists, ensuring that outbound connections to its IP address 103.27.177.163 are blocked at network perimeters. Continuous monitoring of DNS query logs for lookups to the four listed nameservers can help detect internal hosts that may attempt to resolve the malicious domain. Security teams should also incorporate the single vendor detection into endpoint detection and response (EDR) rule sets to increase visibility of any attempted connections. Given the limited detection footprint, correlating internal logs with the known OTX pulse identifiers may provide early warning of related activity. Organizations are advised to maintain up‑to‑date threat intelligence feeds and to re‑evaluate the domain’s status regularly, as additional indicators such as new blocklist listings or increased vendor detections could raise its risk profile.