koreancapital[.]live

The domain koreancapital.live was registered on June 17 2026 via Global Domain Group LLC. It resolves to IP 65.181.113.31, hosted on nameservers ns1.hostingnigeria.com ns2.hostingnigeria.com ns3.hostingnigeria.com ns4.hosting. The domain has been added to the PhishDestroy blocklist and appears on one additional security blocklist. A VirusTotal scan involving 91 antivirus engines returned no positive detections at the time of analysis, but the absence of detections does not constitute assurance of legitimacy.

No SSL certificate data, HTTP response codes, or page title information were available at the time of this assessment. The registrar information and recent creation date are consistent with a short‑lived infrastructure often employed in phishing campaigns. The IP address is not presently associated with known malicious infrastructure in public threat feeds, but its recent activation and co‑location with a Nigerian hosting provider warrant scrutiny.

Defenders should continue to block the domain at the network perimeter, monitor DNS queries for the domain and its associated nameservers, and consider adding the IP address to reputation filters. Ongoing observation of threat‑intel feeds for any emergence of detections or community reports is advised. Because the domain is currently marked as active and under investigation, any observed credential submission attempts targeting the domain should be logged and escalated according to incident‑response procedures.