wagoplays[.]com

Analysis of wagoplays.com indicates active credential phishing infrastructure operating as of July 12, 2026. The domain, registered on February 21, 2026, through Key-Systems GmbH, currently resolves to 104.21.23.198, an address hosted on AS13335 (Cloudflare, Inc.) in the United States. The site returns a 200 HTTP status, signaling an accessible web page with no SSL certificate in place. Nameservers ns1.emailverification.info and ns2.emailverification.info are configured, a pattern previously associated with phishing campaigns targeting email validation and authentication workflows. Security vendors have flagged the domain, with 3 out of 95 engines on VirusTotal detecting malicious activity. While this detection rate remains low, the domain appears on one security blocklist and has been proactively blocked by at least one threat intelligence provider. The page title, wagoplays.com, matches the domain name exactly, a common tactic used to avoid immediate suspicion while presenting a seemingly legitimate interface to visitors. The absence of an SSL certificate further suggests a lack of basic security measures, increasing the likelihood of interception or manipulation of user-submitted data. Infrastructure analysis reveals the domain’s creation date aligns with recent phishing trends, where newly registered domains are frequently weaponized within weeks of registration. The use of Cloudflare’s network provides operational resilience and anonymity, complicating takedown efforts. Defenders should treat this domain as high-risk, particularly for campaigns targeting login credentials or personal information. Network-level blocking of 104.21.23.198 and monitoring of associated nameservers is recommended. Organizations should also assess whether internal users have interacted with the domain and review authentication logs for anomalous activity linked to this infrastructure.