dopalo[.]tougas-bas[.]at

The domain dopalo.tougas-bas.at was identified as a brand impersonation phishing site targeting WordPress users. Analysis confirms this domain operated under the threat category of brand_impersonation, specifically mimicking WordPress login or administrative interfaces to harvest credentials. As of the latest verification, the domain has been taken offline, though prior activity warrants continued monitoring. Infrastructure analysis reveals this domain was flagged by 17 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It was registered through IONOS SE and resolved to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The domain lacked an SSL certificate, a common red flag for phishing sites. It appeared on two security blocklists, including PhishDestroy and PhishingDB, and displayed a page title matching a Cloudways-hosted subdomain: wordpress-1531153-5903397.cloudwaysapps.com. No creation date was provided, but the combination of indicators suggests recent malicious activity. While currently offline, the domain’s prior behavior and infrastructure characteristics pose residual risks. Organizations should ensure this domain remains blocked at the network level and monitor for any re-activation or similar impersonation attempts. Security teams are advised to review logs for connections to 188.114.97.3 or the Cloudways subdomain, particularly from users who may have interacted with WordPress-related content. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for affected accounts.