nzz[.]fwf[.]temporary[.]site

Analysis of nzz.fwf.temporary.site, created on August 04, 2023 and currently active, shows a high‑risk brand‑impersonation campaign targeting WordPress users. The domain is registered through ENOM, INC. and resolves to IP address 69.6.196.178, which belongs to an Autonomous System (AS31898) operated by Oracle Corporation in France. The host presents a 302 HTTP redirect and serves a page titled "Welcome — Coming Soon" under an SSL certificate issued by Let’s Encrypt (R13). Technical fingerprinting identifies WordPress, MySQL, PHP, Apache HTTP Server, and jQuery on the front‑end, confirming the use of a legitimate web stack to lend credibility.

Infrastructure evidence includes authoritative nameservers ns1.temporary.site and ns2.temporary.site, as well as a single MX record for mail.nzz.fwf.temporary.site with priority 0. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 out of 100, the domain appears on one security blocklist, and PhishDestroy has already blocked it. VirusTotal reports 17 detections out of 95 scanned vendors, reinforcing the malicious classification. The campaign’s explicit objective is brand impersonation of the WordPress platform, as indicated by the "Impersonates: wordpress" tag.

Defenders should block the domain at perimeter filters, add the IP to threat‑intel feeds, and monitor for any outbound connections to the host. Email gateways should reject or quarantine messages directed to the listed MX host. Continuous re‑scanning of the domain is advised, as the current evidence set does not reveal the specific payload or credential‑harvesting mechanisms employed. Until further detail emerges, the domain should be treated as hostile and excluded from allow‑lists.