pagosnominalia[.]wpenginepowered[.]com

pagosnominalia.wpenginepowered.com is flagged as a brand‑impersonation site targeting WordPress. The domain resolves to the IP address 141.193.213.11, which is hosted by Cloudflare (ASN 209242) and geolocated in the United States. Infrastructure analysis shows the presence of Cloudflare services and HTTP/3 support, while the TLS certificate is issued by Let’s Encrypt (E8) and matches the domain name. A VirusTotal scan reports that ten of ninety‑five security vendors have marked the domain as malicious, and the site is listed on at least one external blocklist and has been actively blocked by PhishDestroy.

The HTTP response currently returns a 404 status code, and the site is recorded as offline, indicating that the malicious content is no longer being served. The page title captured from the last known snapshot reads “juan paolo jury Site – Your SUPER‑powered WP Engine Site”, which aligns with the WP Engine hosting platform indicated by the “wpenginepowered.com” suffix and suggests a deliberate attempt to exploit the trust associated with WordPress hosting. Nameserver lookup failed (NS_NOT_FOUND), further limiting attribution of the registrar beyond the indication that the domain was registered through WPENG.

Because the domain is offline, immediate threat exposure is limited, but the observed infrastructure—particularly the use of a reputable CDN and a legitimate‑sounding SSL certificate—demonstrates a typical evasion technique that can be reused in future campaigns. Defenders should add the IP address 141.193.213.11 and the full domain to outbound and inbound blocklists, monitor for any re‑registration of the same sub‑domain pattern, and ensure that web filtering solutions incorporate the current blocklist entries.