pdi[.]or[.]kr

The domain pdi.or.kr has been identified as a generic phishing threat with an elevated risk level. No specific brand or drainer kit was detected, but the domain's structure and behavior strongly indicate a phishing campaign targeting unsuspecting users. Currently offline, this domain posed a significant risk while active, leveraging deceptive techniques to mimic legitimate services.

Technical analysis reveals that pdi.or.kr resolves to IP address 146.56.181.8, with 9 out of 95 security vendors on VirusTotal flagging it as malicious. The domain was registered on February 26, 2026, through Whois Corp. (http://whois.co.kr), and its SSL certificate was issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36. The page title displayed a generic "Privacy error" indicating a possible SSL-related phishing tactic. The domain does not appear on Google Safe Browsing (GSB) lists but is present on 1 security blocklist.

As of the latest check, pdi.or.kr has been taken offline, rendering it currently inaccessible. Response actions likely include takedown procedures by the hosting provider or registrar. However, residual risks remain as similar domains may reappear under different names or IPs. Users who may have interacted with the site should monitor for any suspicious activity. PhishDestroy recommends blocking related IPs and remaining vigilant against lookalike domains registered through Whois Corp.