krw21[.]cc

Krw21.cc is an active phishing domain that has been flagged by 3 out of 92 vendors on VirusTotal, indicating a low but notable detection rate. The domain is hosted by Cloudflare, Inc., and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It is currently listed on one public blocklist, specifically PhishDestroy's.

The domain's hosting IP is located in Canada, and it uses an SSL certificate issued by Let's Encrypt. The relatively low detection rate on VirusTotal suggests that this domain may be exploiting the time window between its registration and the propagation of threat intelligence to antivirus databases. This period often spans 24 to 72 hours, during which phishing domains can operate with reduced risk of detection.

Krw21.cc's registration with NICENIC INTERNATIONAL GROUP CO., LIMITED and hosting through Cloudflare are common traits among phishing domains, which frequently leverage reputable services to appear legitimate. The domain's presence on PhishDestroy's blocklist highlights its identification as a threat, despite limited recognition by other security vendors.

Security teams should be aware of the domain's active status and its potential to conduct phishing attacks. The combination of a low detection rate and its appearance on a blocklist underscores the importance of early detection and proactive threat mitigation strategies.