bk1bp4r[.]isweb[.]co[.]kr

This domain, bk1bp4r.isweb.co.kr, was observed on July 29, 2026 as part of an elevated‑risk generic phishing campaign. DNS resolution points to the IPv4 address 172.66.173.30, which is the sole host associated with the domain at the time of analysis. The domain appears on a single external security blocklist, indicating that at least one independent threat‑sharing feed has flagged it for malicious use. VirusTotal has processed the domain and two of ninety‑one scanned security vendors returned a positive detection, confirming that automated scanners have identified suspicious activity linked to the host. In addition, the anti‑phishing service PhishDestroy has actively blocked the domain, reinforcing the classification of the infrastructure as malicious.

The available evidence does not include details such as SSL certificate data, HTTP response codes, page titles, or any attribution to a specific phishing kit. Consequently, the precise payload, targeted brand, or victim profile remains unknown. The limited detection footprint—only one blocklist entry and two vendor flags—suggests that the campaign may be in an early stage or employing low‑profile hosting to avoid broader exposure. Defenders should add bk1bp4r.isweb.co.kr to existing deny lists and configure network controls to drop traffic to 172.66.173.30.

Continuous monitoring of the IP address for new domain registrations or changes in DNS records is advised. Organizations using threat‑intelligence feeds should treat the domain as a confirmed phishing indicator and correlate any internal alerts that reference the same IP or host name with this report. Because the underlying content has not been publicly harvested, further investigation—such as sandbox retrieval of the landing page—may yield additional indicators of compromise. Until more detailed forensic data becomes available, the domain should be considered actively malicious and blocked at perimeter and endpoint layers.