snsrfrkskf[.]jdevcloud[.]com

The domain snsrfrkskf.jdevcloud.com was observed hosting a site whose HTML title reads “Your WordPress! Site hosted with CloudAccess.net”. The title indicates an attempt to masquerade as a legitimate WordPress hosting service, consistent with the listed brand target “wordpress” and the scam classification “Brand Impersonation”. The domain resolves to the IPv4 address 185.187.254.203, which belongs to AS29024 (Hostek AB) and is geolocated to Sweden. DNS resolution is served by the authoritative name servers ns1.gridfast.net and ns2.gridfast.net.

Registration data show the domain was created on 16 February 2015 through the registrar eNom, LLC, and no SSL certificate is present, meaning traffic is served over plain HTTP. The site has been taken offline at the time of analysis, and the hosting provider is listed as CloudAccess.net in the page title, though the underlying infrastructure points to a generic hosting environment. Reputation checks reveal a Gridinsoft trust score of 0 out of 100, indicating a highly malicious rating. The domain is listed on one security blocklist and has been flagged by PhishDestroy. VirusTotal analysis recorded nine detections out of ninety‑five scanners, reinforcing the malicious assessment.

No additional public threat‑intel feeds such as OTX or Safe Browsing were referenced in the supplied data. Given the combination of brand impersonation, low trust score, multiple vendor detections, and the presence on a blocklist, defenders should treat the domain as a confirmed malicious actor. Network defenders should block DNS resolution and HTTP traffic to 185.187.254.203, update intrusion‑prevention signatures to include the domain, and monitor for any future re‑registration. Because the site is currently offline, no active payload delivery can be observed, but the infrastructure remains under the same IP range, suggesting potential reuse for other campaigns.