get-krwq[.]com

The domain get-krwq.com was registered on May 19, 2026 through Fewmoretaps OU d/b/a Trustname.com and immediately assigned to Cloudflare’s DNS infrastructure (elsa.ns.cloudflare.com, kirk.ns.cloudflare.com). It presents a Let's Encrypt/E7 TLS certificate, indicating a valid HTTPS endpoint, yet HTTP requests return a 403 status code, a pattern often used to obscure malicious landing pages while allowing credential submission via hidden forms.

Infrastructure analysis shows the domain resolves to IP 104.21.0.174, an address owned by Cloudflare, Inc. and geolocated to Canada. The same IP hosts multiple unrelated sites, suggesting the attacker is leveraging shared hosting to hide behind reputable services. Gridinsoft assigns the domain a trust score of 0 out of 100, and it appears on a single security blocklist, reinforcing the low reputation assessment.

Threat intelligence sources corroborate malicious intent: AlienVault OTX lists the domain in one pulse, and VirusTotal reports that one out of ninety‑five scanned security vendors flagged the site, consistent with early‑stage detection of phishing infrastructure. PhishDestroy has already added the domain to its blocklist, confirming active abuse. The limited number of detections may reflect recent deployment, but the combination of high risk level, active status, and low trust score signals a credible credential‑harvesting operation.

Defenders should prioritize immediate remediation by blocking DNS resolution for get‑krwq.com and any traffic to its associated IP address. Continuous monitoring of outbound connections to Cloudflare‑hosted IP ranges is advised, as the attacker could pivot to additional domains. Incident response teams should also review logs for attempted credential submissions that may have been directed to this domain, and consider sinkholing the IP to disrupt further phishing campaigns.