kr-partners[.]asia

Analysis of kr-partners.asia indicates a deliberate attempt to impersonate Google for malicious purposes. The domain was registered on October 01, 2025 through Web Commerce Communications Limited and is hosted on the IP address 37.120.144.154, which is assigned to AS9009 M247 Europe SRL and geographically located in Hungary. Both authoritative name servers, ns1.tohosting.com and ns2.tohosting.com, resolve to this hosting provider, confirming the infrastructure footprint. The site lacks an SSL certificate, a common characteristic of low‑cost phishing operations, and its Gridinsoft trust score is 0 out of 100, reflecting a high likelihood of malicious intent.

Security monitoring has placed the domain on a single blocklist and it is actively blocked by PhishDestroy, reinforcing the assessment of abuse. VirusTotal scanned the domain and recorded a single positive detection out of 95 security vendors, providing additional corroboration. The current operational status is offline, indicating that the site has been taken down or is otherwise inaccessible. No page title information is available, and the absence of a valid HTTPS endpoint limits further content‑level verification.

While the available data clearly ties the domain to a Google brand impersonation scheme, the lack of visible payload or phishing page content leaves the exact attack vector uncertain. Defenders should continue to monitor the IP address and associated name servers for any re‑activation, enforce blocklists that include kr-partners.asia, and consider adding the domain to corporate web filtering policies. Threat‑intel sharing platforms should be updated with the registration, hosting, and detection details to aid broader community awareness.