ww[.]helpcenter-checkpoint-057353435646[.]fwh[.]is

Analysis indicates that ww.helpcenter-checkpoint-057353435646.fwh.is is actively used for a generic phishing campaign. The domain was registered on 1 November 2024 and resolves to the IPv4 address 113.20.119.30. Hosting is provided through the Byet hosting network, as evidenced by the four Byet‑owned nameservers (ns1.byet.org through ns4.byet.org). The infrastructure has been listed on at least two public blocklists and is currently blocked by the PhishDestroy and OpenPhish feeds, confirming its malicious reputation.

VirusTotal scans show that nine of ninety‑one antivirus or URL‑reputation engines flag the domain, reinforcing the detection consensus. No public page title or SSL certificate details were supplied, and the content of the landing page has not been disclosed, leaving the exact visual lure uncertain. However, the classification as generic phishing is supported by the blocklist entries and the detection count. The domain remains active as of the report date (5 August 2026), indicating continued operation.

Defenders should add 113.20.119.30 and the full domain name to network‑level deny lists, update proxy and DNS filtering policies, and monitor for any outbound connections to the identified nameservers. Continuous re‑scanning with VirusTotal or similar multi‑engine services is recommended to capture any changes in detection scores. Organizations using email or web gateways should ensure that the domain is included in phishing‑specific block rules to prevent credential harvesting attempts.