fored[.]or[.]kr

The domain fored.or.kr is currently active and classified as a high‑risk generic phishing site. It resolves to the IPv4 address 211.218.150.75, which belongs to AS4766 Korea Telecom and is geolocated in South Korea. Registration was performed through Gabia, Inc., and the domain was created on July 23, 2009. Authoritative name servers are ns1.namesvr.net and ns2.namesvr.net. The site presents a valid TLS certificate issued by GlobalSign nv‑sa under the GlobalSign GCC R6 AlphaSSL CA with expiration in 2025, indicating that encrypted connections are available. An HTTP request returns a 200 status code, and the server stack includes Apache HTTP Server with jQuery detected in the page markup. The page title "해외자원개발 :: 해외자원개발" is the only visible content; no further analysis of the page layout or credential collection mechanisms is available. The domain appears on two security blocklists (PhishDestroy and CryptoFirewall) and is referenced in a single AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that three of ninety‑five scanning engines flag the domain as malicious. Given the observed infrastructure, defenders should block fored.or.kr at perimeter firewalls and DNS resolvers, add the IP address 211.218.150.75 to any sinkhole or deny‑list, and update intrusion‑detection signatures to include the observed Apache and jQuery fingerprint. Continuous monitoring of DNS queries for this domain and its name servers is advised, as well as periodic re‑scans to detect any changes in payload or hosting.