trackderlivryes[.]cloudaccess[.]host

trackderlivryes.cloudaccess.host was observed hosting a page titled “Your WordPress! Site hosted with CloudAccess.net”. The page title directly references WordPress, indicating a brand impersonation attempt targeting WordPress users. The domain resolves to the IP address 185.187.254.203, which is registered to AS29024 (Hostek AB) in Sweden. Registration metadata shows the domain was provisioned through Softpro‑cloud2, also associated with ASN 29024. No SSL certificate is presented for the host, and DNS queries for authoritative nameservers return no results, suggesting a minimal or misconfigured DNS setup.

The site is currently offline, which aligns with reports that the domain has been taken down. Reputation services assign a Gridinsoft trust score of 0 out of 100, indicating extreme distrust. VirusTotal analysis recorded detections from 15 of 95 scanned security vendors, confirming that multiple engines flag the domain as malicious. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. While the available data confirms the presence of brand‑impersonation infrastructure, the exact content of the landing page, any credential‑capture mechanisms, and the full scope of the campaign remain unverified because the site is offline.

Defenders should continue to block traffic to the IP address 185.187.254.203 and add the domain to URL filtering policies. Monitoring for new sub‑domains or similar hostnames under the same ASN is advised, as threat actors often reuse hosting infrastructure. Network sensors should flag any HTTP requests lacking TLS to this host, and incident response teams should treat any emails referencing “Your WordPress! Site hosted with CloudAccess.net” as suspicious. Ongoing intelligence gathering is recommended to capture any re‑appearance of the domain or related infrastructure.