darechchaouen[.]com

This domain, darechchaouen.com, is currently classified as a high‑risk brand‑impersonation campaign. The site returns HTTP 200 and presents the page title “Dar Echchaouen Riad – Your Blue Paradise in the Heart of Chefchaouen”, yet intelligence flags it as an impersonation of the generic “base” brand. The threat level is high and the domain remains active as of 12 July 2026.

Infrastructure analysis shows the domain resolves to IP 192.250.229.162, hosted in Germany and advertised under AS209341 (WHG Hosting Services Ltd). The domain was created on 30 April 2014 and is registered through NameSilo, LLC. Authoritative name servers are ns1.mysecurecloudhost.com, ns2.mysecurecloudhost.com, ns3.mysecurecloudhost.com and an additional ns entry, indicating use of a third‑party cloud DNS provider.

Reputation signals are uniformly negative. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal records a single positive detection out of 95 scanners. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. An SSL certificate issued by Google Trust Services (WE1) is present, but the certificate does not mitigate the malicious intent.

The available evidence confirms impersonation activity targeting the “base” brand, but the exact nature of the fraudulent content has not been publicly disclosed. No additional payloads, redirects, or credential‑harvesting forms have been observed in the available data set, leaving the specific attack vector uncertain.

Defenders should add darechchaouen.com to network‑level deny lists and block traffic to 192.250.229.162. Continuous monitoring of the associated name servers and WHOIS changes is advised, as the infrastructure could be repurposed. Security appliances that reference PhishDestroy or similar blocklists will already flag the domain, but manual rule updates ensure coverage across all detection layers.