wordelicious[.]net

Analysis of the domain wordelicious.net indicates active phishing infrastructure with a high-risk classification. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to IP 172.67.209.133 (AS13335, United States). Nameservers are hosted under Cloudflare (dakota.ns.cloudflare.com, grannbo.ns.cloudflare.com). No SSL certificate is present, and the HTTP response status is 200, suggesting an operational web server. The page title, 'Default Web Site Page,' provides no explicit brand impersonation details, though Google Safe Browsing flags the domain for social engineering.

Detection data reveals 19 of 93 security vendors on VirusTotal flagging the domain as malicious. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist (PhishDestroy). AlienVault OTX includes the domain in two threat intelligence pulses. While the exact phishing target remains unconfirmed due to the generic page title, the combination of detection vendor flags, blocklist presence, and Safe Browsing classification indicates a credible threat.

Defenders should treat this domain as hostile and implement blocking at the DNS or proxy level. Monitor for connections to 172.67.209.133 or the domain in logs, particularly for social engineering attempts. Given the Cloudflare hosting and lack of SSL, additional scrutiny of related infrastructure is recommended. No evidence of a specific phishing kit or brand impersonation is available at this time, but the domain’s creation date and detection history suggest it is actively used for malicious purposes.