werknest[.]cc

This domain is flagged as a high-risk credential harvesting phishing site targeting users of collaboration platforms. Analysis indicates the domain, werknest.cc, is designed to mimic legitimate productivity tools, luring victims into submitting sensitive login credentials through fraudulent interfaces. The threat type is classified as generic_phishing with a focus on credential theft, posing significant risks to both individual and organizational security. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 28, 2026. Detection metrics show 4 out of 95 security vendors on VirusTotal have flagged the domain, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services under the identifier WE1, which may lend a false sense of legitimacy to unsuspecting users. The domain remains active, with a page title of Werknest - Built to Collab., further reinforcing its deceptive branding. Mitigation against this threat requires immediate action. Network administrators should block the domain and its associated IP address at the perimeter level. End-users should be educated on recognizing phishing indicators, such as mismatched URLs, suspicious SSL issuers, and unsolicited login prompts. Multi-factor authentication should be enforced for all accounts to reduce the impact of credential theft. Monitoring for unauthorized access attempts linked to this domain is strongly recommended.