superofferss[.]com

The domain superofferss.com is currently active and has been identified as a brand‑impersonation campaign targeting the WordPress brand. The site was registered on February 21 2026 through Hosting Concepts B.V. operating as Registrar.eu. Its public page title mirrors the domain name, providing no additional context.

Infrastructure analysis shows the domain resolves to the IP address 185.173.111.153, which is assigned to AS47583 Hostinger International Limited located in Brazil. The host uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. The site presents a valid Let's Encrypt R13 TLS certificate, which can be leveraged to add credibility to phishing pages if the HTTP response changes. However, HTTP requests currently receive a 403 status, limiting visible content and leaving the exact malicious payload unknown.

Threat intelligence sources reinforce the malicious profile. The domain appears on two security blocklists and is listed by PhishDestroy and CryptoFirewall as blocked. VirusTotal reports five of ninety‑five scanning engines flagging the domain, and AlienVault OTX includes it in six separate threat pulses. The Gridinsoft trust score is 0 out of 100, reflecting extreme risk.

Defenders should treat superofferss.com as hostile. Immediate mitigation steps include adding the domain and its resolving IP to outbound and inbound deny lists, updating web‑filtering rules, and monitoring for any DNS queries to the associated nameservers. Given the recent registration date, the infrastructure is likely to be short‑lived, but the association with a reputable hosting provider does not mitigate the observed threat indicators. Continuous re‑evaluation is advised to capture any future changes in payload or hosting, especially if the 403 response is replaced by active phishing content.