kast-community[.]xyz

Analysis of kast-community.xyz, taken offline as of the report date, shows a clear infrastructure profile consistent with a high‑risk brand‑impersonation operation targeting WordPress users. The domain was registered on February 21, 2026 through eNom, Inc., and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution uses the Cloudflare authoritative nameservers frank.ns.cloudflare.com and mia.ns.cloudflare.com. No SSL certificate was detected, leaving the site accessible only over plain HTTP, a characteristic often observed in rapid‑deployment phishing or impersonation campaigns.

The page title returned by the server reads "Your WordPress! Site hosted with CloudAccess.net," indicating an attempt to appear as a legitimate WordPress hosting environment, though the actual content has not been captured because the site is offline. Threat intelligence signals are strong: VirusTotal recorded 17 detections out of 93 security vendors, the Gridinsoft trust score is 0 / 100, and Google Safe Browsing flags the domain for social engineering. The domain appears on three independent blocklists, specifically PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that it is being used for malicious purposes.

While the precise phishing payload or credential‑harvesting page cannot be verified at this time, the combination of registrar, hosting, lack of TLS, and multiple independent detections provides compelling evidence of a brand‑impersonation threat. Defenders should proactively block DNS resolution for kast-community.xyz, add the associated IP address 188.114.96.3 to network‑level deny lists, and ensure that any outbound connections to Cloudflare‑hosted services originating from internal users are monitored for anomalous activity.