https://accounts.evilash.ccwu.cc/LGrnlbuj
43.161.231.117 · Tencent Cloud Computing (Beijing) Co., Ltd
Hong Kong, Hong Kong
264 days
200 · 27.6s
Valid· E8, Let's Encrypt, US
COMPLETED
Domain Intelligence: ccwu.cc
Scanned 4 times since May 9, 2026, 01:35 AM UTC
Registered-domain escalation suggested
Suggested nowSubmit ccwu.cc as the primary IOC, enriched with evidence from hostile subdomains like accounts.evilash.ccwu.cc.
2 hostile subdomains across 2 completed scans were observed under this registered domain. Recent hosts: accounts.evilash.ccwu.cc, www.qq.com.
No KB/IOK detections were recorded for this scan.
technology | finance | ecommerce | other · 6/3/2026
The page presents a security check UI with an embedded iframe loading content from the same domain path, and the screenshot shows a generic credential-collection style card without explicit branding. The domain does not match a known large brand, and WHOIS shows a recently registered domain with a Let’s Encrypt SSL. The SPA-like behavior and iframe suggest potential credential collection via dynamic content, but there is insufficient explicit evidence of a specific brand impersonation in the static HTML. Treat as suspicious due to iframe usage and SPA rendering; further investigation required to confirm credential harvesting or impersonation against a known brand.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 0
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 2
Hosts: 1
Domains: 1
The domain is new (264 days old per WHOIS), uses a wildcard Let’s Encrypt certificate, and loads an iframe from the same domain rendering a credential-like UI. The screenshot attached shows a generic verification dialog rather than a recognized brand login interface, but the presence of an iframe-based UI and dynamic loading strongly suggests potential credential capture flow. Given the combination of SPA rendering, iframe usage, and lack of visible legitimate branding, this warrants cautious interpretation as a suspicious/login-collection attempt on a non-brand domain. Recommend monitoring and additional verification of any credential collection endpoints or data exfiltration behaviors.
Monitor