s138213830nk[.]jdevcloud[.]com

The domain s138213830nk.jdevcloud.com was observed hosting a page titled "Your WordPress! Site hosted with CloudAccess.net" and is classified as a brand‑impersonation campaign targeting WordPress users. Infrastructure analysis shows the domain resolves to IP address 185.187.254.203, which is allocated to Hostek AB in Sweden under ASN 29024. Registration details indicate the domain was provisioned through the Softpro‑cloud2 registrar, also associated with ASN 29024.

No SSL certificate is present, and authoritative name server information could not be retrieved (NS_NOT_FOUND), suggesting the domain may have been deliberately minimized to avoid detection. The site was flagged by multiple security vendors: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reported five detections out of ninety‑five scanners, confirming malicious intent. The domain appears on a single public blocklist and has been actively blocked by the PhishDestroy mitigation service. Current status is offline, which limits immediate observation of HTTP responses or payloads.

While the exact phishing mechanism (e.g., credential‑harvesting form) has not been disclosed, the combination of brand‑impersonation, lack of encryption, low trust score, and vendor detections provides sufficient confidence to treat the domain as malicious. Defenders should ensure that any outbound connections to 185.187.254.203 are denied, update web‑filter and DNS blocklists to include s138213830nk.jdevcloud.com, and monitor for related subdomains or infrastructure reuse within the Hostek AB range. Continuous threat‑intel feeds should be consulted for any resurgence of the domain, and incident response teams should be prepared to investigate any compromised WordPress credentials that may have originated from this host.