krufpv.org 피싱 및 보안 점검

The domain krufpv.org was registered on July 18, 2022 through NameCheap, Inc. It resolves to the IP address 185.199.109.153, which is announced by AS54113 Fastly, Inc. in the United States. The authoritative nameservers are dns1.registrar-servers.com and dns2.registrar-servers.com. An active HTTPS service is provided by a Let’s Encrypt certificate (R13). Infrastructure analysis shows the web server is fronted by Varnish caching and Fastly CDN, with the underlying site hosted on GitHub Pages. The HTTP response code is 200, and the page title returned by the server is “KwadsRUs Racing Club”. The site is listed on one public blocklist, PhishDestroy, and appears in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100, and two of ninety‑five VirusTotal scanners have flagged the domain as malicious. The available intelligence classifies the activity as generic phishing, but the exact content of the page has not been examined, so the specific credential‑stealing technique or lure remains unknown. No additional indicators such as malicious payload hashes, phishing email samples, or victim reports have been disclosed. The low trust score and blocklist presence suggest a high likelihood of malicious intent, yet the limited number of vendor detections indicates that the payload may be newly observed or not yet widely distributed. Defenders should block network connections to krufpv.org and monitor DNS queries for the associated IP and nameservers. Email security gateways should be tuned to flag any messages that reference the “KwadsRUs Racing Club” title or link to the domain. Because the site uses a legitimate Let’s Encrypt certificate, certificate pinning is ineffective; instead, reputation‑based filtering and rapid sharing of the observed indicators with threat‑share platforms are recommended. Continuous re‑evaluation is advised as additional detections may emerge.