pkcw[.]com

The domain pkcw.com is currently active and was created on 1 April 2006. It is registered through GoDaddy.com, LLC and uses the authoritative name servers ns03.domaincontrol.com and ns04.domaincontrol.com. DNS resolution points to the IPv4 address 18.167.93.14, which belongs to AS16509 Amazon.com, Inc. and geolocates to Hong Kong. The site presents an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (R12). Technical fingerprinting reveals a Windows Server operating system hosting Microsoft ASP.NET applications behind Internet Information Services.

Analysis shows the site is deliberately crafted to impersonate the decentralized finance platform 1inch, as indicated by the threat classification of brand impersonation and the explicit brand target. The page title displayed in Chinese reads “買比特幣(BTC)-購買比特幣|最好的比特幣交易平臺|比特幣交易所”, which translates to a Bitcoin purchase offering and aligns with the reported cryptocurrency scam type. Reputation services flag the domain with a Gridinsoft trust score of 0 out of 100 and VirusTotal records 13 out of 95 security vendors marking it malicious. The domain appears on one security blocklist and is listed as blocked by PhishDestroy, reinforcing its malicious standing.

Given the high risk rating, defenders should immediately add pkcw.com to network and endpoint blocklists, enforce DNS sinkholing of its name servers, and monitor for connections to the 18.167.93.14 address. TLS inspection can confirm the Let’s Encrypt certificate chain, and traffic inspection should look for ASP.NET/IIS signatures typical of this infrastructure. Continuous monitoring of the domain’s registration and hosting details is advised, as changes to the hosting provider or certificate could indicate further campaign evolution. Incident response teams should treat any credential or payment information submitted to this site as compromised.