cwrtwright[.]com

This domain, cwrtwright.com, operates as a credential harvesting portal designed to mimic legitimate corporate or service provider login interfaces. Its primary objective is to deceive users into entering sensitive authentication details, such as usernames, passwords, or multi-factor authentication codes, which are then captured by threat actors for unauthorized access to accounts, data exfiltration, or further malicious activities like business email compromise or lateral movement within networks. Analysis indicates the domain is registered through Web Commerce Communications Limited dba WebNic.cc, a registrar frequently associated with high-risk domains. The domain is flagged by 23 out of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence sources. Infrastructure analysis reveals it resolves to the IP address 104.21.36.145, a Cloudflare-associated IP often used to obfuscate hosting origins. The domain employs a Let's Encrypt SSL certificate (YE2), a tactic commonly used to lend an appearance of legitimacy to phishing sites. It has been blocked by at least one security blocklist and is currently offline, though this status may change. Users who visited cwrtwright.com or entered credentials on the site should assume their information has been compromised. Immediate actions include resetting passwords for any accounts accessed or entered on the site, enabling multi-factor authentication where available, and monitoring affected accounts for unauthorized activity. System administrators should block the domain and its associated IP (104.21.36.145) at the network perimeter to prevent access. If corporate credentials were exposed, initiate an internal investigation to assess potential unauthorized access or data breaches. Report the incident to relevant cybersecurity teams or threat intelligence platforms to contribute to broader defensive measures.