click[.]wranglerdenver[.]info

Analysis of click.wranglerdenver.info indicates an active credential phishing domain targeting users through a redirect mechanism. The domain, registered on May 24, 2026, via NameSilo, LLC, currently resolves to IP address 172.67.183.156, hosted on Cloudflare infrastructure in Canada. The page title 'Redirecting...' suggests an intermediate step designed to forward victims to a fraudulent login portal, though the final destination remains unconfirmed due to the lack of direct page content analysis. Infrastructure review reveals Cloudflare nameservers (eva.ns.cloudflare.com, chip.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which may provide a false sense of legitimacy to end users. The domain appears on one security blocklist, and 19 of 91 security vendors on VirusTotal flag it as malicious, reinforcing its classification as a high-risk threat. The scam type is explicitly identified as credential phishing, though the specific brand or service being impersonated is not yet determined from available data. Defenders should prioritize blocking this domain at the DNS or network level, particularly given its recent registration and continued activity. Monitoring for related subdomains or IP associations with 172.67.183.156 may help identify additional threats linked to the same infrastructure. Given the use of Cloudflare, takedown efforts may require coordination with the hosting provider to disrupt the campaign.