dnswel[.]cc

The domain dnswel.cc is currently active and involved in a credential harvesting phishing campaign. It masquerades to capture sensitive login information, posing an elevated risk to users who may interact with it. There is no specific brand impersonation identified at this time, but the threat centers on deceiving users into submitting credentials through fraudulent means.

This domain was created on March 25, 2026, and is registered through Global Domain Group LLC. It resolves to the IP address 188.114.97.3 and uses an SSL certificate issued by Let's Encrypt, which may lend a false sense of security to victims. According to VirusTotal, 3 out of 95 security vendors have flagged dnswel.cc as malicious. The domain's presence on relevant blocklists is currently noted as elevated, further underscoring the domain's threat potential. These technical indicators collectively contribute to its low trust score.

Given the active status and elevated risk level of dnswel.cc, users and organizations should proactively block access to this domain at network perimeters. End users should be advised to avoid clicking links or submitting credentials on unfamiliar sites, especially those not verified as legitimate. Continuous monitoring of related IP activity and updating security filters with this domain information will help mitigate potential compromise from this credential harvesting scheme.