wpqpdldsallslsss[.]com

This domain, wpqpdldsallslsss.com, is flagged as a generic phishing site specifically impersonating Blackwell's, a known bookseller brand. The page title, "Blackwell's, books for life and for learning Blackwell's," directly replicates the legitimate brand's identity, likely to deceive users into entering credentials or financial details. No crypto drainer kit signatures were observed, but the infrastructure aligns with credential harvesting or payment fraud tactics. Analysis indicates this is a targeted brand impersonation campaign rather than a broad-scale phishing operation. Infrastructure analysis reveals the domain was registered on June 11, 2026, through NAMECHEAP INC, a registrar frequently abused for malicious activity. It resolves to the IP address 172.67.179.130, hosted behind Cloudflare, which is commonly leveraged to obfuscate origin servers. The domain is detected by 16 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and uses an SSL certificate issued by Google Trust Services. Technologies detected include Google Tag Manager, Cloudflare Browser Insights, and HTTP/3, suggesting an attempt to mimic legitimate e-commerce infrastructure. The domain is currently offline, having been taken down following detection and blocking by security mechanisms. However, residual risk remains due to the potential for the operators to redeploy the infrastructure under a new domain or IP. Users who interacted with the site should assume credential exposure and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP, and to scan for any internal traffic to 172.67.179.130 during the active period. The creation date discrepancy (2026) may indicate domain squatting or a typo in registration records, warranting further investigation into the registrar's logs.