wordpress-207173-0[.]cloudclusters[.]net

Analysis of the domain wordpress-207173-0.cloudclusters.net indicates it was actively involved in a brand impersonation campaign targeting Facebook. The domain, registered on February 21, 2026, through registrar NetEarth One, Inc., resolved to the IP address 108.181.157.241, hosted on AS40676 (Psychz Networks) in the United States. At the time of assessment, the domain was offline, though it had been flagged by at least one security blocklist and detected by 7 of 95 security vendors on VirusTotal, suggesting prior malicious activity.

The absence of an SSL certificate and the use of CloudClusters nameservers (ns1.cloudclusters.net, ns2.cloudclusters.net) align with patterns observed in low-effort phishing infrastructure. The page title, 'wordpress – Just another WordPress site,' does not provide definitive evidence of the exact content served, but the scam type is explicitly classified as brand impersonation in available threat intelligence. Defenders should treat this domain as compromised infrastructure and prioritize blocking both the domain and its resolving IP within network security controls.

Given the domain's current offline status, further forensic analysis may be limited, but historical DNS and WHOIS records should be preserved for potential incident response. The Gridinsoft trust score of 0/100 reinforces the assessment of elevated risk, though the lack of additional context (e.g., phishing kit signatures, payload samples) prevents a more granular classification.