website[.]kwmobi[.]com

Analysis of website.kwmobi.com, a domain created on 2026-02-21 and registered through Dominet (HK) Limited, indicates that the site is presently offline and responds with an HTTP 404 status code. The domain resolves to the IP address 166.117.233.8, which belongs to Amazon.com, Inc. under ASN 16509 and is geolocated in the United States. DNS delegation points to the authoritative nameservers ns7.alidns.com and ns8.alidns.com, and the web server software identified is Nginx. A TLS certificate is presented for the host, issued by DigiCert Inc under the RapidSSL TLS RSA CA G1 chain, confirming the use of a reputable certificate authority.

The only page title captured before the takedown is "The Heiress’s Revenge: I Refuse Your 200,000 Dollars," a phrase consistent with the generic phishing classification assigned to this indicator. The domain appears on a single security blocklist and has been explicitly flagged by PhishDestroy as taken offline. VirusTotal scans have returned three positive detections out of ninety‑three scanning engines, demonstrating that multiple vendors have identified the domain as malicious.

No additional content or phishing payload has been observed, leaving the exact victim targeting or lure technique unconfirmed. Defensive recommendations include immediate blocking of the domain and its associated IP address at DNS and network perimeter controls, purging any cached DNS entries, and continuous monitoring of the hosting ASN (AS16509) and the registrar (Dominet (HK) Limited) for potential reuse in future campaigns. Maintaining an elevated risk rating for this indicator is warranted until further activity is detected or the infrastructure is definitively retired.