admin2[.]ondoc[.]co[.]kr

admin2.ondoc.co.kr is flagged as a high‑risk generic phishing domain. The site returns HTTP 200 and presents a page title of “Laravel”, indicating a likely backend framework but no further content has been disclosed. The domain was created on 27 February 2026 and is registered through Megazone (HOSTING.KR). Its authoritative name servers are ns-1290.awsdns-33.org, ns-168.awsdns-21.com, ns-1743.awsdns-25.co.uk and ns-840.awsdns, suggesting reliance on Amazon Route 53 DNS infrastructure.

The domain resolves to IP 110.10.129.234, which belongs to AS9318 SK Broadband Co Ltd in South Korea. The host runs Nginx and serves a valid Let’s Encrypt certificate (E7), a pattern commonly observed in short‑lived malicious infrastructure. No additional web‑application kits were identified beyond the Laravel title, and Gridinsoft assigns a trust score of 0 / 100, reflecting extreme suspicion.

VirusTotal analysis shows 16 of 95 security vendors flagging the domain, and the domain appears on a single public blocklist. PhishDestroy has already blocked it, confirming that at least one anti‑phishing feed considers it malicious. The presence on only one blocklist does not reduce the threat, as the vendor consensus already flags it. The risk rating is high and the status remains active.

Defenders should add 110.10.129.234 and the full domain name to outbound and inbound deny lists, enforce TLS inspection to capture any credential submissions, and monitor DNS queries for the listed name servers. Continuous re‑scanning on VirusTotal and integration of blocklist feeds will help track any changes in vendor detection. Organizations may also consider sinkholing the domain and coordinating with local ISPs in South Korea. Given the recent registration date, rapid propagation of this indicator is possible, so swift remediation is advised.