koreaxrp[.]com

The domain koreaxrp.com was registered on 2026-02-21 through NiceNIC International Group Co., Limited and remains active. Authority is delegated to the Cloudflare name servers aitana.ns.cloudflare.com and margo.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and edge infrastructure. DNS resolution points to IP 172.67.186.69, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. TLS termination is provided by a Google Trust Services WE1 certificate, indicating a valid HTTPS connection via Cloudflare. Google Safe Browsing has flagged the URL for SOCIAL_ENGINEERING, and 17 of 95 VirusTotal scanners have reported it as malicious, supporting a high‑risk assessment. The domain appears on one public blocklist and is also listed by PhishDestroy. An HTTP 403 response prevents retrieval of the page content, so the exact phishing payload cannot be confirmed, though the reported scam type is a Crypto Scam, implying attempts to deceive victims into cryptocurrency‑related fraud. Defenders should block DNS resolution for koreaxrp.com, add the associated IP address 172.67.186.69 to network deny lists, and monitor for outbound connections to Cloudflare edge nodes that may be leveraged for malicious activity. Continuous re‑scanning is recommended, as Cloudflare can host multiple unrelated sites behind the same IP address. Key indicators of compromise include the domain name, the two Cloudflare name servers, and the resolved IP address.