wonderlandgrinning[.]shop

This domain, wonderlandgrinning.shop, was registered on June 12, 2026 through Namecheap, Inc. The authoritative name servers are sergi.ns.cloudflare.com and teresa.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution returns the IPv4 address 125.124.123.122, which is the sole host observed for the domain. The domain is listed as active and assigned an elevated risk level. VirusTotal analysis shows that five of ninety‑one security vendors have flagged the domain, confirming malicious intent.

The domain is already blocked by the PhishDestroy feed and appears on one additional public blocklist, reinforcing its classification as a phishing infrastructure. No public SSL certificate information, HTTP status code, or page title has been published, and the domain does not currently appear in Google Safe Browsing, Open Threat Exchange, or other commonly referenced reputation services. Consequently, the full web‑service behavior remains unverified. Defenders should immediately add wonderlandgrinning.shop to DNS‑level block lists and enforce URL filtering to prevent user access.

Network perimeter devices should deny traffic to 125.124.123.122, and any existing connections to that address should be terminated. Continuous monitoring of the IP and periodic rescanning with VirusTotal or similar multi‑engine platforms are advised to capture any changes in detection scores. Integration of the domain and its hosting IP into existing SIEM correlation rules will help surface related malicious activity. Because the underlying web server details are unknown, additional threat‑intel collection, such as requesting a full HTTP fetch or TLS handshake, is recommended to enrich the profile and support downstream mitigation.