fl[.]kwdmv[.]cc

The domain fl.kwdmv.cc was registered on 12 June 2026 through Dominet (HK) Limited. Within weeks of its creation it began appearing on security blocklists, currently listed on one known blocklist and actively blocked by PhishDestroy. Public scanning on VirusTotal shows that 13 of 91 antivirus and URL‑filtering engines have flagged the domain as malicious, indicating a moderate level of consensus among security products. The domain resolves to the IP address 172.67.206.209, an address hosted on a cloud service provider commonly used for transient malicious infrastructure. No further infrastructure details such as ASN or geographic location are disclosed in the available data.

The limited detection history suggests the site is being used for a generic phishing campaign, but the specific lures or target brands have not been identified because page content, HTTP response codes, SSL certificate details, or page titles have not been published. Consequently, the exact nature of the phishing payload remains uncertain. Defenders should treat fl.kwdmv.cc as a high‑confidence indicator of compromise. Immediate actions include adding the domain to outbound web filtering and DNS‑sinkhole policies, ensuring it is blocked at perimeter security appliances, and monitoring for any internal DNS queries to the associated IP address.

Because the domain is newly created, threat actors may reuse the same registration pattern for future campaigns; thus, security teams should also flag any new domains registered by Dominet (HK) Limited that resolve to the same IP range. Continuous re‑scanning on multi‑engine platforms such as VirusTotal is advised to capture any evolution in detection scores. Logging of HTTP(S) requests to the domain and correlating with authentication failures can help identify compromised credentials. In summary, the evidence points to an active phishing site that warrants proactive blocking and vigilant monitoring.