wormtownrag[.]com

The domain wormtownrag.com was observed on July 12, 2026 and is classified as a confirmed phishing site. The site returned HTTP 200 and presents the page title “Michael Cheemson,” which is the only visible content currently indexed. The domain was created on February 21, 2026 and is listed as active. Infrastructure analysis shows the domain is registered through Tucows Domains Inc. and resolves to the IPv4 address 80.78.22.244, which is hosted in Denmark and associated with AS39287 Materialism s.r.l. The authoritative nameservers are 1-you.njalla.no, 2-can.njalla.in, and 3-get.njalla.fo, indicating use of the Njalla privacy‑focused DNS service. TLS termination is provided by CloudFlare, Inc., confirming that the site is served over HTTPS. The domain appears on one public security blocklist and has been flagged by PhishDestroy. VirusTotal scans report that four out of ninety‑five security vendors have identified the domain as malicious, reinforcing the high‑risk rating assigned by analysts. No additional threat‑intel such as malware hashes or credential‑stealing kits has been published. Current intelligence does not include a detailed content analysis of the landing page, so the exact phishing vector, target audience, or credential capture mechanism remains unknown. Absence of observed payloads or exfiltration endpoints limits attribution of any broader campaign, but the presence of a legitimate‑looking page title suggests a possible social‑engineering attempt. Defenders should add wormtownrag.com to network and email filtering rules, block the resolved IP address 80.78.22.244, and monitor DNS queries for the listed Njalla nameservers. Continuous re‑scanning of the domain with sandbox and URL reputation services is advised to detect any future changes in payload or hosting. Incident response teams should treat any credential submissions linked to this domain as compromised.