appsnd[.]taxwl[.]cc

The domain appsnd.taxwl.cc was registered on September 14, 2025 through Dominet (HK) Limited and currently resolves to the IPv4 address 170.106.160.91. Threat intelligence sources have classified the domain as a generic phishing site, and it is listed on a single security blocklist. The PhishDestroy service has actively blocked the domain, indicating that it is being used in ongoing malicious campaigns. VirusTotal analysis shows that 13 out of 91 security vendors flag the domain as malicious, providing additional confirmation of its abusive nature.

No public page title, SSL certificate details, or HTTP response codes have been disclosed, so the exact content served by the site remains unknown. Likewise, Safe Browsing, OTX, and other reputation feeds have not been reported, leaving the broader ecosystem impact uncertain. Defenders should prioritize immediate mitigation by adding appsnd.taxwl.cc and its hosting IP 170.106.160.91 to network blocklists and DNS sinkhole configurations.

Continuous monitoring of the IP address for new associations is advised, as threat actors often reuse infrastructure across campaigns. Given the registrar location in Hong Kong and the relatively recent creation date, the domain may be part of a short‑lived phishing operation, but the presence on multiple vendor blocklists suggests a higher likelihood of active exploitation. Organizations should also review outbound traffic for connections to this host and enforce strict credential‑handling policies to reduce the risk of credential harvest from potential phishing attempts originating from this domain.