wc-provider-para-rg[.]net

Analysis of wc-provider-para-rg.net indicates that the domain was registered on 9 November 2025 through CNOBIN INFORMATION TECHNOLOGY LIMITED and is currently taken offline. The domain resolves to IP address 57.129.97.29, which belongs to the OVH SAS network (AS16276) and is geolocated in Germany. Cloudflare authoritative nameservers (abdullah.ns.cloudflare.com, fay.ns.cloudflare.com) are configured, but no TLS certificate is present, implying HTTP-only service at the time of observation. Threat intelligence sources label the site as a generic phishing operation.

Two of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. No additional data such as page title, brand targeting, or malware kit is available, so the precise content of the phishing page cannot be corroborated.

Given the limited but consistent indicators—registrar details, hosting under a known hosting provider, lack of SSL, low trust score, and multiple detections—defenders should treat wc‑provider‑para‑rg.net as a confirmed malicious resource. Network sensors should block outbound connections to 57.129.97.29, and DNS filtering policies should deny resolution of the domain. Incident response teams encountering traffic to this domain should consider it a phishing indicator and apply standard containment and user‑awareness procedures. Continuous monitoring of the IP and related OVH ranges is advisable, as the infrastructure may be reused for future campaigns.