bk1bp4r38cu2j[.]isweb[.]co[.]kr

The domain bk1bp4r38cu2j.isweb.co.kr is currently classified as an active generic phishing infrastructure with an elevated risk rating. It appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Registration information shows the domain was created through the Megazone registrar, and the authoritative DNS records are served by Cloudflare, using the nameservers chris.ns.cloudflare.com and jocelyn.ns.cloudflare.com. DNS resolution points to the IP address 104.20.31.159, which is associated with Cloudflare's edge network, indicating the use of a widely shared hosting platform to obscure the true location of the malicious payload. VirusTotal analysis reports that two of ninety‑one security vendors have flagged the domain, providing limited but corroborating evidence of malicious activity.

At present, no public page title, SSL certificate details, or content snapshots have been released, leaving the exact landing page characteristics unknown. Consequently, defenders cannot rely on signature‑based detection of page elements but must instead focus on the observable network and reputation indicators. The low number of vendor detections may reflect limited exposure rather than benign intent, and the domain's use of Cloudflare's infrastructure is consistent with typical phishing operators seeking rapid deployment and resilience. Recommended mitigation steps include adding the domain and its resolving IP address to outbound filtering rules, ensuring DNS resolvers enforce blocklist entries that contain the domain, and monitoring for any additional detections from security vendors.

Organizations should also consider employing sandbox or URL‑reputation services to capture any future payloads that may be delivered through this infrastructure. Defenders should correlate internal proxy logs for any HTTP requests to the IP 104.20.31.159 or the domain name, and if observed, trigger incident response procedures.