korunethalzoviq[.]com

This domain, korunethalzoviq.com, is currently flagged as an active phishing site targeting users of Lunvex Asteron, a recognized brand in enterprise software solutions. Analysis indicates the threat type is generic phishing, designed to harvest credentials or distribute malicious payloads under the guise of legitimate corporate communications. The domain remains operational as of the latest verification, posing a high risk to unsuspecting visitors. Infrastructure analysis reveals that korunethalzoviq.com was registered on June 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The domain resolves to the IP address 188.114.96.3 and is flagged by 3 of 95 security vendors on VirusTotal, including detection as a phishing resource. It appears on one security blocklist and has been documented in two threat intelligence pulses on AlienVault OTX. The Gridinsoft trust score for this domain is 0 out of 100, further confirming its malicious classification. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to the site. Current status indicates the domain is still active and has not been taken down by the registrar or hosting provider. Organizations and end-users are advised to block access to 188.114.96.3 and korunethalzoviq.com at the network perimeter. Security teams should monitor for indicators of compromise, including unusual authentication attempts or outbound connections to the identified IP. If Lunvex Asteron branding is used internally, employees should be alerted to verify all communications via official channels. Proactive measures, such as updating endpoint detection rules and reviewing logs for visits to the domain, are recommended to mitigate potential exposure.