go-yalla[.]net

This domain, go-yalla.net, is flagged as an active impersonation threat targeting WordPress, with a high-risk classification as of July 12, 2026. Infrastructure analysis reveals the domain was registered on December 21, 2025, through Hosting Concepts B.V. d/b/a Registrar.eu and currently resolves to IP 172.67.212.31 (AS13335, Cloudflare, Inc., US). The site returns an HTTP 200 status, indicating operational hosting, and employs technologies including WordPress, MySQL, PHP, Bootstrap, and multiple carousel libraries (Swiper, Slider Revolution, Slick, OWL Carousel). The page title is 'Go Yalla,' though the exact content and functionality remain unanalyzed. Defenders should note that the domain appears on one security blocklist, and two of 93 security vendors on VirusTotal have flagged it. The SSL certificate is issued by Google Trust Services (WE1), and nameservers are hosted under Cloudflare (donna.ns.cloudflare.com, howard.ns.cloudflare.com). The Gridinsoft trust score of 0/100 further corroborates its malicious classification. While the domain is confirmed to impersonate WordPress, the specific attack vector—whether credential harvesting, plugin exploitation, or other malicious activity—is not yet determined. Recommended actions include immediate blocking of the domain and IP at network and endpoint layers, monitoring for connections to 172.67.212.31, and reviewing logs for any prior interactions with this infrastructure. Given the use of Cloudflare, defenders should also assess whether additional domains hosted on the same IP or nameservers exhibit similar patterns. Further analysis of the site’s content is advised to identify payloads or redirection mechanisms.