# PhishDestroy domain threat record: cwdex.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cwdex.net/
Machine-readable companion: https://phishdestroy.io/domain/cwdex.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: unknown
- First observed by PhishDestroy: 2026-10-26 16:16:38 UTC
- Stored record updated: 2026-10-26 21:10:44 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.67.220.124
- Registrar in stored WHOIS data: Dominet (HK) Limited
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-04-13 11:40:18 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a16d1f-5c49-7708-a047-747699b438aa/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cwdex.net
- Certificate Transparency search: https://crt.sh/?q=%25.cwdex.net
- Web Archive lookup: https://web.archive.org/web/*/https://cwdex.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy added cwdex.net to its internal blocklist on 2026-10-26 after an admin report noted the domain was 196 days old at that time. The site responded with HTTP 200 but no page title was captured, and no specific malicious behavior was observed.

How the scam works
The current evidence does not demonstrate a concrete phishing, wallet‑draining, or credential‑harvesting scheme. In general, domains classified as suspicious may be used to host fraudulent pages, lure users into disclosing information, or serve as placeholders for future malicious activity.

Evidence
VirusTotal scanned the domain on 2026-10-14 and reported 0 malicious or suspicious detections out of 92 engines. Google Safe Browsing checked the site on 2026-10-26 and did not flag it. URLScan captured the page on 2026-10-24, where automated engines assigned a malicious score of 44, but the overall verdict was non‑malicious; the page returned HTTP 200. OTX listed three pulses mentioning cwdex.net, and PhishDestroy’s internal blocklist marked the domain as suspicious.

Infrastructure
The domain was registered on 2026-04-13 through Dominet (HK) Limited. DNS was observed to return Cloudflare IPs 104.21.17.33 and 172.67.220.124, and the certificate recorded at the time was a Let’s Encrypt certificate valid until 2027-01-05. A Cloudflare web application firewall was observed.

What to do
Treat cwdex.net as potentially unsafe; avoid entering credentials, personal data, or cryptocurrency information on the site. Defenders should add the exact domain to blocklists, monitor access logs for any requests, and apply standard web‑security policies to mitigate possible abuse.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a16d1f-5c49-7708-a047-747699b438aa/
Cloudflare Radar report: https://radar.cloudflare.com/scan/c3c8d796-28ee-4e9b-bac2-c7a9ada8ca40
Stored capture screenshot: https://urlscan.io/screenshots/01a16d1f-5c49-7708-a047-747699b438aa.png
Cloudflare Radar screenshot (2026-10-26T16:18:56Z): https://screenshots.phishdestroy.io/cf/c3c8d796-28ee-4e9b-bac2-c7a9ada8ca40.png
URLScan screenshot (2026-09-01T12:01:51Z): https://screenshots.phishdestroy.io/us/01a05cd8-60b7-762c-9dec-2c66806e78ee.png
URLScan capture report: https://urlscan.io/result/01a05cd8-60b7-762c-9dec-2c66806e78ee/
URLScan screenshot (2026-10-23T18:59:27Z): https://screenshots.phishdestroy.io/us/01a16a20-5998-742d-9600-0fef8db9e8b9.png
URLScan capture report: https://urlscan.io/result/01a16a20-5998-742d-9600-0fef8db9e8b9/
URLScan screenshot (2026-10-23T19:31:05Z): https://screenshots.phishdestroy.io/us/01a16a3e-b10f-777b-8b94-577700549c81.png
URLScan capture report: https://urlscan.io/result/01a16a3e-b10f-777b-8b94-577700549c81/
VirusTotal report: https://www.virustotal.com/gui/domain/cwdex.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cwdex.net
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-26 16:23:41 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a16d1f-5c49-7708-a047-747699b438aa.png
  Captured: 2026-10-26 16:16:38 UTC
- URLScan · 2026-09-01: https://screenshots.phishdestroy.io/us/01a05cd8-60b7-762c-9dec-2c66806e78ee.png
  Captured: 2026-09-01 12:01:51 UTC
  Source report: https://urlscan.io/result/01a05cd8-60b7-762c-9dec-2c66806e78ee/
  SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a20-5998-742d-9600-0fef8db9e8b9.png
  Captured: 2026-10-23 18:59:27 UTC
  Source report: https://urlscan.io/result/01a16a20-5998-742d-9600-0fef8db9e8b9/
  SHA-256: 76b5f45e0b885abc4afd2a35574c5728f449afc80c19a3727cdc1f14c3dd61ab
- URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16a3e-b10f-777b-8b94-577700549c81.png
  Captured: 2026-10-23 19:31:05 UTC
  Source report: https://urlscan.io/result/01a16a3e-b10f-777b-8b94-577700549c81/
  SHA-256: c2081255fa6c12551973a9e66a1aaebf4bf3cc9ff83f7f171ff6fef239416388
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c3c8d796-28ee-4e9b-bac2-c7a9ada8ca40.png
  Captured: 2026-10-26 16:18:56 UTC
  Source report: https://radar.cloudflare.com/scan/c3c8d796-28ee-4e9b-bac2-c7a9ada8ca40
  SHA-256: 9456f0d7ec805cd4e58bad4c97cc09ace7350f0f452647e79724b65f80daf417

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-26T16:22:57Z",
        "uuid": "01a16d1f-5c49-7708-a047-747699b438aa",
        "scanned_at": "2026-10-24T08:55:44Z",
        "final_url": "https://cwdex.net/",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 193,
        "apex_age_days": 193,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 44,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-26T16:22:58Z",
        "uuid": "c3c8d796-28ee-4e9b-bac2-c7a9ada8ca40",
        "scanned_at": "2026-10-26T16:18:56Z",
        "final_url": "https://cwdex.net/",
        "status": 200,
        "history": [
            {
                "url": "https://cwdex.net/",
                "status": 200
            }
        ],
        "dom_hash": "af7f699d60768a3ed032c3d2e8a1fbc27d666b3ee734bf6c7999386c1f7aec64",
        "doc_hash": "e731815ab55749c7bb55281f3af49bf9b2fb81ccb3e5f60964c92db5100f916a",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cwdex.net",
                "type": "A",
                "value": "104.21.17.33"
            },
            {
                "name": "cwdex.net",
                "type": "A",
                "value": "172.67.220.124"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.17.33",
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-04-13T13:40:18Z",
            "updated": "2026-04-13T13:43:15Z",
            "expires": "2027-04-13T13:40:18Z",
            "nameservers": [
                "lia.ns.cloudflare.com",
                "venkat.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-26T16:17:51Z",
        "analysis_at": "2026-10-14T06:53:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 56,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 36
        },
        "reputation": 0,
        "created": "2026-04-13T00:00:00Z",
        "updated": "2026-04-13T00:00:00Z",
        "first_seen": "2026-04-13T14:14:44Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "venkat.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "lia.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.17.33"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.220.124"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "lia.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-14T07:05:32Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.cwdex.net",
                "cwdex.net"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5ba00622a8bce69a5be5057266d3aa8c297",
            "sha256": "47b32e08e1951f341e5e7848d298b56390e7c7747b13f214fdf5ed1a645a3693",
            "subject": "cwdex.net",
            "valid_to": "2027-01-05T12:12:49Z",
            "valid_from": "2026-10-07T12:12:50Z"
        },
        "whois": []
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-26T16:23:20Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "cwdex.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-26T16:21:03Z",
            "first": "2026-10-26T16:21:03Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 9265
        },
        "social_tags": {
            "robots": "all",
            "ogImage": "/platform/dev/logo_144.png?2.0.1772439477262",
            "themeColor": "#ffffff"
        },
        "trackers": {
            "requests": 16
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 47,
                "tls": 26,
                "wait": 473,
                "connect": 6,
                "download": 1
            },
            "response_ms": 553
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 15160,
            "co2_grams": 0.0006,
            "cleaner_than": 63
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.32.185",
                    "host": "lia.ns.cloudflare.com"
                },
                {
                    "ip": "172.64.35.254",
                    "host": "venkat.ns.cloudflare.com"
                }
            ],
            "zone": "cwdex.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "p_uv_id",
                    "http_only": true
                }
            ]
        },
        "location": {
            "ip": "104.21.17.33",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "cwdex.net"
        },
        "dns": {
            "A": [
                "104.21.17.33",
                "172.67.220.124"
            ],
            "NS": [
                "venkat.ns.cloudflare.com",
                "lia.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"lia.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416864390, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "172.67.220.124",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://cwdex.net"
            ]
        },
        "whois": {
            "registrar": "Dominet (HK) Limited",
            "created": "2026-04-13T13:40:18Z",
            "updated": "2026-04-13T13:43:15Z",
            "expires": "2027-04-13T13:40:18Z",
            "status": [
                "ok https://icann.org/epp"
            ],
            "nameservers": [
                "lia.ns.cloudflare.com",
                "venkat.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```