xn--kspanet-rsc[.]com

The domain xn--kspanet-rsc.com was registered on March 11, 2026 through Hostinger operations, UAB. It is delegated to the Hostinger parking nameservers ns1.dns-parking.com and ns2.dns-parking.com and resolves to IP address 2.57.91.91, which is registered to AS47583 Hostinger International Limited in Cyprus. No TLS certificate is presented; the only HTTP response captured is a generic parked‑domain page with the title “Parked Domain name on Hostinger DNS system”. Intelligence tags classify the site as a brand‑impersonation campaign targeting WordPress, as indicated by the “Impersonates: wordpress” label.

AlienVault OTX lists the domain in two separate threat pulses, and three independent security blocklists have added it, specifically PhishDestroy, MetaMask, and SEAL. The Gridinsoft trust score of 0 / 100 reflects a high confidence of malicious intent. VirusTotal analysis recorded a single detection out of ninety‑four scanning engines, further supporting the suspicion. The site’s current status is offline, which may represent a temporary takedown or a deliberate cessation after initial activity.

Uncertainties remain about the precise malicious payload or credential‑harvesting mechanisms because the observed content is limited to a parking page and no additional resources, scripts, or form endpoints were retrieved before the takedown. Consequently, the exact attack vector cannot be confirmed. Defenders should continue to block the domain at network and endpoint layers, monitor for any re‑registration of the punycode label, and add the associated IP address 2.57.91.91 to threat‑intel feeds. Ongoing observation of DNS changes or hosting modifications is advised, as the infrastructure could be repurposed for future WordPress impersonation attempts.