cwsbayi[.]com

The domain cwsbayi.com was registered on February 23, 2026 through NiceNIC International Group Co., Limited and is currently marked as taken offline. Its authoritative nameservers are cory.ns.cloudflare.com and rita.ns.cloudflare.com, indicating that the domain is hosted on Cloudflare’s network (ASN13335, United States). DNS resolution points to the IP address 172.67.176.108, which belongs to Cloudflare’s edge infrastructure. No SSL certificate is presented for the site, meaning HTTPS connections would not be secured.

The only visible attribute on the site is the page title “CWSBayi”, with no additional content disclosed in the available intelligence. Reputation checks show the domain appears on a single security blocklist (PhishDestroy) and received a Gridinsoft trust score of 0 out of 100, the lowest possible rating. VirusTotal analysis recorded three positive detections out of 93 scanned vendors, confirming that multiple security products have flagged the domain as malicious. The combination of a recent registration date, Cloudflare hosting, lack of TLS, low trust score, and multiple vendor detections aligns with typical characteristics of a generic phishing infrastructure.

Because the site is currently offline, active probing is not possible, and the exact payload or credential‑stealing mechanisms remain unknown. Defenders should continue to block cwsbayi.com at perimeter and DNS layers, add the domain to internal deny lists, and monitor for any re‑activation or related sub‑domains. Continuous threat‑intel feeds should be queried for new indicators tied to the IP 172.67.176.108 or the Cloudflare nameservers used, as adversaries frequently recycle such hosting assets for future campaigns.