clickwa[.]cc

This domain is flagged for credential harvesting phishing, a threat type designed to deceive users into submitting account credentials through fraudulent login portals. Analysis indicates the domain was likely engineered for short-term, high-impact attacks targeting unsuspecting users across email, messaging platforms, or malvertising vectors. The elevated risk level reflects its recent creation, absence of legitimate content, and active detection by security systems. Infrastructure analysis reveals the following technical indicators: the domain clickwa.cc resolves to IP address 104.21.78.130, hosted on Cloudflare’s network (AS13335). It was registered on June 25, 2025, through NiceNIC International Group Co., Limited, with no SSL certificate present. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious. The page title, "404 — Page Not Found," suggests either a takedown, evasion tactic, or placeholder state. The domain appears on one security blocklist and is currently offline, though this status may change. No historical content or legitimate use cases were identified. Mitigation requires immediate blocking of the domain and its resolving IP across network security controls. Organizations should implement DNS filtering to prevent resolution, while endpoint protection systems must be configured to detect and quarantine any attempts to access this domain. Security teams are advised to monitor logs for connections to 104.21.78.130 and review authentication attempts from users who may have interacted with the domain prior to takedown. User awareness training should emphasize identifying phishing indicators, particularly in unsolicited messages requesting login credentials. Given the domain’s recent creation and lack of SSL, any future reappearance should be treated as a high-confidence threat.