wnkodc[.]com

The domain wnkodc.com is currently active and returns HTTP 200 responses. DNS resolution points to the IPv4 address 45.43.63.10, which is assigned to AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED and geolocated in Singapore. The domain was registered on 2024-01-06 through PDR Ltd. d/b/a PublicDomainRegistry.com and is served by Cloudflare nameservers heidi.ns.cloudflare.com and jake.ns.cloudflare.com. The site presents a page titled "DEMO" and is built with Vue.js, leveraging external libraries from unpkg.com and decimal.js.

A Let’s Encrypt certificate (issued by the E7 intermediate) secures the HTTPS endpoint, indicating that TLS is correctly configured despite the malicious intent. Reputation checks show a Gridinsoft trust score of 0 out of 100, and the domain is listed on two public blocklists, specifically PhishDestroy and ScamSniffer. VirusTotal analysis records that two of ninety‑five scanners have flagged the domain, reinforcing the suspicion of abuse. No additional detection services are cited, and the exact nature of the phishing payload has not been disclosed in the available intelligence.

Given the combination of a low trust score, blocklist entries, a valid TLS certificate used to lend legitimacy, and the presence of client‑side JavaScript frameworks, the infrastructure aligns with known phishing deployment patterns. Defenders should block or sinkhole the domain at the network perimeter, monitor DNS queries for the associated IP and nameservers, and incorporate the domain’s hash into endpoint detection rules. Continuous re‑evaluation is advised, as further payload details may emerge.