zw[.]cc

The domain zw.cc has been identified as a confirmed generic phishing infrastructure. Analysis of public records shows that the site returns an HTTP 302 redirect and presents the page title “ZW.CC”. The certificate in use is issued by Let’s Encrypt (R13), indicating a valid TLS endpoint that may lend credibility to the malicious page.

Registration data reveals that zw.cc was created on 13 October 1997 and is listed with the registrar 22net, Inc. The domain resolves to the IPv4 address 86.105.245.69, which is hosted in Romania and assigned to SC 2K Telecom SRL. No additional hosting or CDN services are evident beyond the direct resolution.

Threat intelligence sources corroborate the malicious nature of the domain. AlienVault OTX references a single pulse linking zw.cc to phishing campaigns. VirusTotal scans have resulted in three of ninety‑five security vendors flagging the domain, and the Gridinsoft trust score is 0 / 100. The site is actively blocked by PhishDestroy and appears on one external security blocklist, reinforcing its hostile reputation.

Defenders should incorporate zw.cc into URL filtering, DNS sinkholing, and endpoint allow‑list exclusions. Continuous monitoring of the associated IP address and any future DNS changes is advised, as the infrastructure could be leveraged for additional malicious campaigns. Updating intrusion detection signatures to flag the Let’s Encrypt certificate fingerprint and the observed HTTP 302 response may improve early detection.