herzwurf[.]com

This domain is flagged for hosting a fake login portal designed to harvest user credentials through deceptive authentication interfaces. Analysis indicates the threat type aligns with credential phishing, where victims are tricked into entering sensitive account details into fraudulent forms. The risk level is classified as elevated due to the domain's active distribution in phishing campaigns and its presence on security blocklists. Infrastructure analysis reveals the domain herzwurf.com resolves to the IP address 172.67.202.101 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 04, 2026, an unusually forward-dated registration that may indicate attempts to evade detection. VirusTotal detection metrics show 13 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and holds a Gridinsoft trust score of 0/100, further corroborating its malicious classification. The domain has since been taken offline, though historical activity suggests prior engagement in phishing operations. Mitigation measures for this threat type include immediate blocking of the domain and its associated IP address (172.67.202.101) at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to herzwurf.com or similar domains registered via NICENIC INTERNATIONAL GROUP. End-users should be educated on recognizing phishing indicators, such as mismatched URLs, unsolicited login requests, and domains with low trust scores. Multi-factor authentication should be enforced to mitigate the impact of credential theft, and security teams should monitor for signs of compromised accounts linked to this campaign.