labsapp-alkimi[.]org

Analysis of labsapp-alkimi.org indicates an active brand‑impersonation campaign targeting WordPress users. The domain was registered on September 09 2025 through Hostinger Operations UAB and uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to IP 92.113.16.5, which belongs to AS47583 Hostinger International Limited and is geolocated in Germany. No TLS certificate is presented, meaning the site is served over plain HTTP. An HTTP request returns a generic “Default page” title, offering no further content clues.

Security‑vendor scanning on VirusTotal recorded 3 detections out of 95 engines, and the domain appears on a single public blocklist. PhishDestroy has also listed the host as malicious. The Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The site is currently taken offline, but the infrastructure elements remain observable.

Evidence confirms the intent to impersonate the WordPress brand, as indicated by the “Impersonates: wordpress” label and the “Brand Impersonation” scam type. No additional payload, login page, or malicious script details are available from the limited data set, leaving the exact impersonation vector uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP range for any re‑use, and update threat‑intelligence feeds with the observed indicators. Organizations using WordPress should educate users about the lack of a valid SSL certificate and the generic default page, and consider adding the domain to internal blocklists until the host is fully retired.