dkid[.]org

Analysis of dkid.org, first observed on 26 February 2026, shows that the domain resolves to the IPv4 address 103.164.81.237, which is allocated to AS142002 Scloud Pte Ltd and geolocated in Hong Kong. The site presented the HTML title “DBS iBanking”, indicating an attempt to impersonate the online banking portal of DBS. A TLS certificate labeled “R13” was presented, a low‑trust indicator that aligns with typical phishing deployments. Reputation checks reveal a Gridinsoft trust score of 0 out of 100 and a single entry on a security blocklist, confirming that external defenses have already flagged the host.

The domain appears in one AlienVault OTX pulse and has been blocked by PhishDestroy, reinforcing community‑wide recognition of malicious intent. VirusTotal analysis returned 14 detections out of 93 scanning engines, providing multi‑vendor corroboration of the threat. The current HTTP status is offline, suggesting the site has been taken down or is no longer serving content. Evidence is limited to registration data, hosting details, page title, SSL metadata, and vendor detection counts; no payload samples, phishing page screenshots, or command‑and‑control infrastructure have been captured.

Consequently, confidence that dkid.org is a phishing infrastructure targeting DBS customers is high, while the exact phishing kit and victim interaction flow remain unknown. Defenders should immediately add 103.164.81.237 and dkid.org to deny‑list rules, enforce DNS and URL filtering for the domain, and monitor for any resurgence of the same IP or similar titles. Continuous ingestion of updated OTX and blocklist feeds is advised, as is periodic re‑scanning should the domain reappear online. Organizations with DBS accounts should be warned of potential credential‑harvesting attempts referencing the “DBS iBanking” title, and user‑education campaigns should emphasize verification of legitimate banking URLs.