waurl[.]cc

This domain is flagged as an elevated-risk phishing infrastructure specifically designed for credential harvesting. Analysis indicates waurl.cc operates as a fake login portal, tricking users into submitting account credentials for unauthorized access. The domain exhibits no legitimate content, as evidenced by the 404 — Page Not Found response, suggesting it was either taken down post-compromise or repurposed solely for malicious redirects. Infrastructure analysis reveals the domain waurl.cc was registered on July 10, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.134.221, hosted on AS13335 (Cloudflare, Inc.) in the United States. The domain lacks an SSL certificate, increasing exposure to interception risks. Security vendors on VirusTotal flagged waurl.cc with 19/95 detections, and it appears on one security blocklist, specifically PhishDestroy. The domain is currently offline, though historical activity confirms its use in phishing campaigns. Mitigation steps for this credential-harvesting threat include blocking the domain and its resolving IP (172.67.134.221) at the network perimeter. Organizations should monitor for unauthorized access attempts linked to credentials potentially compromised via waurl.cc. End-users who interacted with the domain should reset passwords immediately, enable multi-factor authentication, and review account activity for anomalies. Security teams are advised to correlate logs for connections to 172.67.134.221 or domains registered through NiceNIC during the July 2025 timeframe.