app21836[.]cloudwayssites[.]com

The domain app21836.cloudwayssites.com was registered on February 21, 2026 through NameCheap, Inc. It resolves to the IP address 162.159.130.73, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the page title "Awesome WordPress Application" and did not serve an SSL certificate at the time of observation. Reputation data indicates that the domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis recorded three positive detections out of ninety‑five scanned security vendors, confirming that at least a subset of scanning engines consider the domain malicious.

Independent scoring from Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the low confidence in the domain's safety. The nameservers abby.ns.cloudflare.com and johnny.ns.cloudflare.com are typical Cloudflare endpoints, suggesting the infrastructure is using Cloudflare's DNS service, a common choice for short‑lived malicious hosts. The current status is reported as offline, which may indicate takedown or temporary suspension.

While the available data confirms the domain’s association with phishing‑related blocklists and multiple vendor detections, no direct sample of the hosted content has been captured, leaving the specific phishing payload or targeted brand unverified. Defenders should continue to block traffic to this domain at network perimeter and DNS layers, monitor any residual connections from infected hosts, and incorporate the indicator set (domain, IP, registrar, and blocklist entries) into threat‑intel feeds. Ongoing vigilance is advised in case the domain becomes reactivated or re‑hosted on alternative infrastructure.