corevision[.]com[.]tw

On 27 July 2026, investigators examined corevision.com.tw, a domain registered through the FET/NCIC registrar on 14 August 2006. The domain resolves to the IPv4 address 107.161.177.42 and is served by four name servers – ns1.peacesoft.in, ns2.peacesoft.in, ns10347.dizinc.com and ns10348.dizinc.c – indicating a distributed DNS configuration possibly intended to increase resilience. Google Safe Browsing classifies the site as a social engineering threat, and the domain appears on two external security blocklists. Both PhishDestroy and SEAL have added it to their block lists, confirming that active mitigation services are already targeting the infrastructure. VirusTotal scans show that 14 out of 91 anti‑malware engines have flagged the domain, reinforcing the suspicion of malicious use.

The current risk rating is high and the status remains active, suggesting that the phishing infrastructure is still operational. No public evidence of the website’s content, SSL certificate details, or HTTP response codes is available in the supplied intelligence, leaving the exact phishing campaign vector undefined. The lack of page‑title or brand targeting information prevents attribution of the specific lure employed. Nonetheless, the convergence of multiple independent detections—Google Safe Browsing, blocklist listings, and vendor flags—provides a strong indication that the domain is being leveraged for generic phishing attempts.

Defenders should continue to block corevision.com.tw at network perimeter devices, DNS resolvers, and endpoint web filters. Given the persistent hosting on 107.161.177.42, monitoring for outbound connections to that IP and for DNS queries to the listed name servers is advisable. Organizations using threat‑intelligence feeds that incorporate Google Safe Browsing, PhishDestroy, or SEAL should ensure the domain is included in their deny lists.