ctwhj[.]com

Analysis of ctwhj.com indicates this domain is actively involved in phishing operations as of July 17, 2026. Registered on October 17, 2025, through Alibaba Cloud Computing Ltd. (HiChina), the domain remains under the control of its original registrant. Infrastructure analysis reveals the use of Cloudflare nameservers (anuj.ns.cloudflare.com) alongside less common providers (ns1.julydns.com, ns1.onclouddns.com), a pattern frequently observed in phishing campaigns seeking redundancy and evasion. The domain currently resolves to IP address 64.83.41.193, though no hosting provider or autonomous system details have been confirmed. Threat intelligence platforms have begun flagging ctwhj.com, with AlienVault OTX listing it in one threat pulse. VirusTotal reports two security vendors detecting the domain as malicious, though the specific nature of the threat—whether credential harvesting, malware distribution, or another attack vector—has not been publicly detailed. The domain's creation date, eight months prior to this report, suggests it was established specifically for malicious use rather than being a compromised legitimate site. Defenders should treat ctwhj.com as high-risk infrastructure. Network-level blocking is recommended, particularly for organizations using cloud services, as the domain may be targeting login credentials or session tokens. No brand or service has been conclusively linked to this domain in available data, so generic phishing detection rules should be applied. Further investigation into the resolved IP (64.83.41.193) and associated domains may reveal additional related infrastructure. Given the domain's continued activity and lack of legitimate use indicators, monitoring for new subdomains or IP changes is advised.