cn[.]kkmxxw[.]com

Analysis indicates that cn.kkmxxw.com is currently active and has been identified as a generic phishing site. The domain resolves to 172.67.189.141, an address owned by Cloudflare, Inc. (AS13335) and is hosted in the United States. Registration data shows the domain was created on 24 November 2019 through GoDaddy.com, LLC, and the authoritative name servers are pdns107.ultradns.biz, pdns107.ultradns.com, pdns107.ultradns.net, and pdns107.ultradns.org. The site presents an HTTP 200 response and serves a page titled “MX落地页”. Technical fingerprinting reveals the use of Node.js with the Express framework, client‑side libraries jQuery and jQuery UI, and analytics services Google Analytics and Baidu Analytics. Security headers include HSTS, and the TLS certificate is issued by Sectigo Limited under a DV R36 public server authentication CA. Reputation services flag the domain as highly suspicious: it appears on two security blocklists, is blocked by PhishDestroy and PhishingDB, and receives a Scamadviser trust score of 1/100 and a Gridinsoft score of 0/100. VirusTotal scans report that 15 of 95 antivirus engines flag the domain as malicious. No public evidence of additional payloads or credential‑stealing infrastructure has been observed beyond the phishing classification. Defenders should treat traffic to cn.kkmxxw.com as malicious. Immediate actions include adding the domain and its resolving IP address to deny‑list or firewall rules, updating URL filtering policies, and monitoring for outbound connections to the Cloudflare edge node. Continuous monitoring of the associated IP for any new malicious activity is advised, as the underlying hosting provider may be leveraged for other campaigns. Given the high risk rating and active status, proactive blocking and alerting are recommended.